{"id":"CVE-2022-39352","published":"2022-11-08T00:00:00Z","modified":"2025-04-23T16:39:59Z","title":"OpenFGA Authorization Bypass","vendor":"openfga","product":"openfga","tier":"tail","description":{"text":"OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00457,"percentile":0.39642,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-3gfj-fxx4-f22w","tags":[]}],"priority":{"score":11.3,"factors":[{"name":"EPSS percentile","points":7.93},{"name":"CVSS severity","points":3.36}]},"vendorSlug":"openfga","affectedVersions":[{"vendor":"openfga","product":"openfga","versions":["< 0.2.5"]}],"affected":[{"ecosystem":"Go","package":"github.com/openfga/openfga","vulnerableRanges":["<0.2.5"],"patched":["0.2.5"],"from":["GHSA-3gfj-fxx4-f22w","GO-2022-1099"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7210","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-39340","published":"2022-10-25","fixed":"0.2.4","kev":false,"link":{"from":"CVE-2022-39340","to":"CVE-2022-39352","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/openfga/openfga","fromFixed":"0.2.4","toFixed":"0.2.5","daysApart":14}]}},{"cve":"CVE-2022-39341","published":"2022-10-25","fixed":"0.2.4","kev":false},{"cve":"CVE-2022-39342","published":"2022-10-25","fixed":"0.2.4","kev":false},{"cve":"CVE-2022-39352","published":"2022-11-08","fixed":"0.2.5","kev":false},{"cve":"CVE-2022-23542","published":"2022-12-20","fixed":"0.3.1","kev":false},{"cve":"CVE-2023-35933","published":"2023-06-26","fixed":"1.1.1","kev":false},{"cve":"CVE-2023-40579","published":"2023-08-25","fixed":"1.3.1","kev":false}],"package":"Go:github.com/openfga/openfga"}}