CVE-2024-42473 OpenFGA Authorization Bypass

What is CVE-2024-42473?

CVE-2024-42473 is a high-severity authentication bypass vulnerability in openfga, published on 9 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `but not` and `from` expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As of time of publication, a patch is not available but OpenFGA's maintainers are planning a patch for inclusion in a future release.

Weakness: CWE-863

Which versions are affected by CVE-2024-42473?

3 open source packages ship an affected version, including github.com/openfga/openfga. It affects 1 product.

Products include Openfga Openfga.

How do I fix CVE-2024-42473?

Upgrade github.com/openfga/openfga to 1.5.9 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-42473 being exploited?

There is no known exploitation of CVE-2024-42473 in the wild and no public exploit code.

Other vulnerabilities in openfga

• CVE-2024-31452 OpenFGA Authorization Bypass High 8.1
• CVE-2022-23542 OpenFGA Authorization Bypass High 7.7
• CVE-2026-40293 OpenFGA Playground Preshared Key Exposure Medium 6.5
• CVE-2023-40579 OpenFGA Authorization Bypass Medium 6.5
• CVE-2023-43645 Denial of service from circular relationship definitions in OpenFGA Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3f6g-m4hr-59h8, GO-2024-3061.