CVE-2022-39341
Fixed upstream EPSS 1%CVSS 5.9
OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard (`*`) defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue.
Products: openfga
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/openfga/openfga | 0.2.4 |