CVE-2022-23542CWE-285

OpenFGA Authorization Bypass

High · published December 20, 2022

CVSS v3.1
7.7
EPSS
1%
Percentile
62.1
In the wild
Unconfirmed
What it is

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00988 · 62.1th percentile
Weakness
CWE-285 · Improper Authorization
Published
2022-12-20T20:15Z
EPSS history
Timeline
  • 20 DEC 20:15Z
    OpenFGA Authorization Bypass
    cvelistv5