CVE-2022-39341 OpenFGA Authorization Bypass

Medium 5.9 Published 25 Oct 2022 Updated 23 Apr 2025

Attackers can bypass authorization checks in OpenFGA if wildcard relations are used in the model, requiring a patch to secure access controls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-39341?

CVE-2022-39341 is a medium-severity authentication bypass vulnerability in openfga, published on 25 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard (`*`) defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue.

Weakness: CWE-285

Which versions are affected by CVE-2022-39341?

3 open source packages ship an affected version, including github.com/openfga/openfga. It affects 1 product.

Package	Affected	Fixed in
`github.com/openfga/openfga` Go	All versions	`0.2.4`
`github.com/openfga/openfga` Go	All versions	`0.2.4`
`github.com/openfga/openfga` Go	All versions	`0.2.4`

Products include Openfga Openfga.

How do I fix CVE-2022-39341?

Upgrade github.com/openfga/openfga to 0.2.4 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-39341 being exploited?

There is no known exploitation of CVE-2022-39341 in the wild and no public exploit code.

Sources

Also known as GHSA-vj4m-83m8-xpw5, GO-2022-1080.