CVE-2026-48096CWE-345CWE-668

OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning

Medium · published June 10, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00133 · 2.5th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-668 · Exposure of Resource to Wrong Sphere
Published
2026-06-10T15:09Z
EPSS history
Timeline
  • 10 JUN 15:09Z
    OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning
    cvelistv5