{"id":"CVE-2025-55213","published":"2025-08-18T19:23:33Z","modified":"2025-08-18T19:49:55Z","title":"OpenFGA Authorization Bypass (Check)","vendor":"openfga","product":"openfga","tier":"tail","description":{"text":"OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.8,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00324,"percentile":0.25433,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-mgh9-4mwp-fg55","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/openfga/openfga/commit/1a7e0e37fc4777c824b2386cac4867a66f3480b0","tags":["x_refsource_MISC"]}],"priority":{"score":9.1,"factors":[{"name":"EPSS percentile","points":5.09},{"name":"CVSS severity","points":4.06}]},"vendorSlug":"openfga","affectedVersions":[{"vendor":"openfga","product":"openfga","versions":[">= 1.9.3, < 1.9.5"]}],"affected":[{"ecosystem":"Go","package":"github.com/openfga/openfga","vulnerableRanges":[">=1.9.3, <1.9.5"],"patched":["1.9.5"],"from":["GHSA-mgh9-4mwp-fg55","GO-2025-3894"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-25151","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2025-25196","published":"2025-02-19","fixed":"1.8.5","kev":false},{"cve":"CVE-2025-46331","published":"2025-04-30","fixed":"1.8.11","kev":false},{"cve":"CVE-2025-48371","published":"2025-05-22","fixed":"1.8.13","kev":false},{"cve":"CVE-2025-55213","published":"2025-08-18","fixed":"1.9.5","kev":false},{"cve":"CVE-2025-64751","published":"2025-11-21","fixed":"1.11.1","kev":false,"link":{"from":"CVE-2025-55213","to":"CVE-2025-64751","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/openfga/openfga","fromFixed":"1.9.5","toFixed":"1.11.1","daysApart":95}]}},{"cve":"CVE-2026-24851","published":"2026-02-06","fixed":"1.11.3","kev":false},{"cve":"CVE-2026-33729","published":"2026-03-27","fixed":"1.13.1","kev":false}],"package":"Go:github.com/openfga/openfga"}}