CVE-2026-55170CWE-178

OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

Low · published July 9, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2026-07-09T21:04Z
EPSS history
Timeline
  • 09 JUL 21:04Z
    OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
    cvelistv5