GHSA-g3pg-frfm-pr2m: Medium severity go/github.com/openfga/openfga vulnerability
Description
In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.
Preconditions
This applies if all of the following are present:
- The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. rel1: (publicuser but not blocked) and rel2 - The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:). - A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection. - Your application uses ListUsers to enumerate or enforce access
Fix
Upgrade to OpenFGA v1.18.1 or greater.
Acknowledgements
OpenFGA would like to thank @5ud0er for the detailed report.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openfga/openfgato a version that resolves this vulnerability.Fixed in 1.18.1 - Upgrade
Upgrade
openfgato a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
Which deployments are affected in practice?
Affected deployments use ListUsers and have an authorization model with an intersection containing a “base but not excluded” operand. The base must be granted through a type-bound public wildcard, and the excluded user must also have a concrete-tuple grant through another operand of that intersection.
What can an attacker or unauthorized user gain from this issue?
A user who should be excluded can be incorrectly returned by ListUsers when the specified model and tuple conditions are met. This can expose that user as authorized if the application relies on ListUsers to enumerate or enforce access.
Are default configurations affected?
The issue is conditional rather than universally affecting all OpenFGA configurations. It requires the specific intersection, exclusion, wildcard, and concrete-tuple arrangement described in the advisory, as well as application use of ListUsers.
How can I remediate the issue?
Upgrade OpenFGA to version 1.18.1 or later. If upgrading is not immediately possible, avoid using ListUsers to enumerate or enforce access for models that meet the affected relation and tuple conditions.