CVE-2026-24851 OpenFGA Improper Policy Enforcement

Q: Which versions are affected by CVE-2026-24851?

3 open source packages ship an affected version, including github.com/openfga/openfga. It affects 2 products.

Q: Is CVE-2026-24851 being exploited?

There is no known exploitation of CVE-2026-24851 in the wild and no public exploit code.

Q: How do I fix CVE-2026-24851?

Upgrade github.com/openfga/openfga to 1.11.3 or later.

Medium 5.8 Published 6 Feb 2026 Updated 6 Feb 2026

Attackers can bypass authorization checks in OpenFGA under specific model and tuple configurations, gaining unauthorized access to protected resources.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24851?

CVE-2026-24851 is a medium-severity missing authorization vulnerability in openfga, published on 6 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22<= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed. The vulnerability requires a model that has a a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access. This vulnerability is fixed in v1.11.3.

Weakness: CWE-863

Which versions are affected by CVE-2026-24851?

3 open source packages ship an affected version, including github.com/openfga/openfga. It affects 2 products.

Package	Affected	Fixed in
`github.com/openfga/openfga` Go	From `1.8.5`	`1.11.3`
`github.com/openfga/openfga` Go	From `1.8.5`	`1.11.3`
`github.com/openfga/openfga` Go	From `1.8.5`	`1.11.3`

Products include Openfga Helm Charts, Openfga Openfga.

How do I fix CVE-2026-24851?

Upgrade github.com/openfga/openfga to 1.11.3 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-24851 being exploited?

There is no known exploitation of CVE-2026-24851 in the wild and no public exploit code.

Sources

Also known as GHSA-jq9f-gm9w-rwm9, GO-2026-4446, MINI-335x-8qrr-94j9, MINI-76h4-mm8p-86vp, MINI-84p7-43cv-8f9p, MINI-85hf-m9pc-2fq5 and 10 more.