CVE-2026-34972CWE-863

OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

Medium · published April 6, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-06T20:41Z
EPSS history
Timeline
  • 06 APR 20:41Z
    OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
    cvelistv5