Log in Start free

openfga

Products

ProductCVEsExploitedLatest
openfga27–Sep 16, 2026

Exploited and recent CVEs

  • CVE-2026-61709 Medium 5.3 OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user 0.4%
  • CVE-2026-55689 Medium 6.8 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset 0.4%
  • CVE-2026-55170 Low 2.1 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions 0.3%
  • CVE-2026-48096 Medium 5.0 OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning 0.1%
  • CVE-2026-41131 Medium 5.0 OpenFGA has Improper Policy Enforcement 0.1%
  • CVE-2026-40293 Medium 6.5 OpenFGA Playground Preshared Key Exposure 0.3%
  • CVE-2026-34972 Medium 5.0 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision 0.2%
  • CVE-2026-33729 Medium 5.8 OpenFGA has an Authorization Bypass through cached keys 0.2%
  • CVE-2026-24851 Medium 5.8 OpenFGA Improper Policy Enforcement 0.3%
  • CVE-2025-64751 Medium 5.8 OpenFGA Improper Policy Enforcement 0.3%
  • CVE-2025-55213 Medium 5.8 OpenFGA Authorization Bypass (Check) 0.3%
  • CVE-2025-48371 Medium 5.8 OpenFGA Authorization Bypass 0.5%
  • CVE-2025-46331 Medium 5.8 OpenFGA Authorization Bypass 0.4%
  • CVE-2025-25196 Medium 5.8 OpenFGA Authorization Bypass 0.4%
  • CVE-2024-56323 Medium 5.8 OpenFGA Authorization Bypass 0.4%
  • CVE-2024-42473 High 7.5 OpenFGA Authorization Bypass 0.5%
  • CVE-2024-31452 High 8.1 OpenFGA Authorization Bypass 0.7%
  • CVE-2024-23820 Medium 5.3 OpenFGA DoS 0.7%
  • CVE-2023-45810 Medium 5.3 OpenFGA denial of service 0.6%
  • CVE-2023-43645 Medium 5.9 Denial of service from circular relationship definitions in OpenFGA 0.9%
  • CVE-2023-40579 Medium 6.5 OpenFGA Authorization Bypass 0.5%
  • CVE-2023-35933 Medium 5.9 OpenFGA denial of service die to circular relationship 1.1%
  • CVE-2022-23542 High 7.7 OpenFGA Authorization Bypass 1.0%
  • CVE-2022-39352 Medium 4.8 OpenFGA Authorization Bypass 0.5%
  • CVE-2022-39340 Medium 5.3 OpenFGA Information Disclosure 0.9%
  • CVE-2022-39341 Medium 5.9 OpenFGA Authorization Bypass 1.1%
  • CVE-2022-39342 Medium 5.9 OpenFGA Authorization Bypass 1.1%