CVE-2025-55213: OpenFGA Authorization Bypass (Check)
Overview OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed.
Am I Affected? You are affected by this vulnerability if you are using OpenFGA v1.9.3 to v1.9.4, specifically under the following preconditions: - Calling Check API or ListObjects with an authorization model that has a relationship directly assignable by more than 1 userset with same type, and - There are check or list object queries that rely on the above relationship, and - You have userset tuples that are assigned to the above relationship
Fix Upgrade to v1.9.5. This upgrade is backwards compatible.
Workaround Downgrade to v1.9.2 with enable-check-optimizations removed from OPENFGAEXPERIMENTALS
Acknowledgments OpenFGA would like Dominic Harries and rrozza-apolitical to thank for discovering this vulnerability.
Other sources
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55213?
The severity of CVE-2025-55213 has not been officially rated, but it involves improper policy enforcement in critical versions of OpenFGA.
How do I fix CVE-2025-55213?
To fix CVE-2025-55213, update OpenFGA to version 1.9.5 or later, and ensure your Helm chart or Docker image is updated accordingly.
Which versions are affected by CVE-2025-55213?
CVE-2025-55213 affects OpenFGA versions 1.9.3 to 1.9.4, as well as Helm charts from 0.2.40 to 0.2.41 and Docker images from 1.9.3 to 1.9.4.
What types of software are impacted by CVE-2025-55213?
CVE-2025-55213 impacts OpenFGA, Helm charts, and Docker images associated with OpenFGA.
What vulnerabilities does CVE-2025-55213 introduce?
CVE-2025-55213 introduces vulnerabilities related to improper policy enforcement, which could lead to unauthorized access.