CVE-2025-46331
Fixed in a distro release EPSS <1%CVSS 5.8
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11.
Products: openfga
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/openfga/openfga | 1.8.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-11.3 | 11.3.9-r5 |
| Chainguard | grafana-11.4 | 11.4.8-r2 |
| Chainguard | grafana-11.5 | 11.5.10-r0 |
| Chainguard | grafana-11.6 | 11.6.7-r0 |
| Chainguard | grafana-11.6 | 11.6.8-r0 |
| Chainguard | grafana-12.0 | 12.0.0-r3 |
| Chainguard | grafana-12.0-oci-compat | 12.0.0-r3 |
| Chainguard | grafana-fips-11.4 | 11.4.8-r2 |
| Chainguard | grafana-fips-11.5 | 11.5.10-r0 |
| Chainguard | grafana-fips-11.6 | 11.6.7-r0 |
| Chainguard | grafana-fips-12.0 | 12.0.0-r2 |
| Chainguard | grafana-fips-12.0-oci-compat | 12.0.0-r2 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250515T200012-1.1 |