CVE-2024-31452 OpenFGA Authorization Bypass

What is CVE-2024-31452?

CVE-2024-31452 is a high-severity authentication bypass vulnerability in openfga, published on 16 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`). This vulnerability is fixed in v1.5.3.

Weakness: CWE-863

Which versions are affected by CVE-2024-31452?

3 open source packages ship an affected version, including github.com/openfga/openfga. It affects 1 product.

Products include Openfga Openfga.

How do I fix CVE-2024-31452?

Upgrade github.com/openfga/openfga to 1.5.3 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-31452 being exploited?

There is no known exploitation of CVE-2024-31452 in the wild and no public exploit code.

Other vulnerabilities in openfga

• CVE-2022-23542 OpenFGA Authorization Bypass High 7.7
• CVE-2024-42473 OpenFGA Authorization Bypass High 7.5
• CVE-2026-40293 OpenFGA Playground Preshared Key Exposure Medium 6.5
• CVE-2023-40579 OpenFGA Authorization Bypass Medium 6.5
• CVE-2023-43645 Denial of service from circular relationship definitions in OpenFGA Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8cph-m685-6v6r, GO-2024-2729.