CVE-2026-55689 | Medium | 6.8 | 2026-07-09 | OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.me… |
CVE-2026-55170 | Medium | 5.4 | 2026-07-09 | OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely… |
CVE-2026-48096 | Medium | 5.0 | 2026-06-10 | OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can… |
CVE-2026-41131 | Medium | 5.0 | 2026-04-22 | OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enable… |
CVE-2026-40293 | Medium | 6.5 | 2026-04-17 | OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentic… |
CVE-2026-34972 | Medium | 5.0 | 2026-04-06 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under sp… |
CVE-2026-33729 | Critical | 9.8 | 2026-03-27 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. In versions prior to 1.13.1, u… |
CVE-2026-24851 | High | 8.8 | 2026-02-06 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( op… |
CVE-2025-64751 | High | 8.8 | 2025-11-21 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( op… |
CVE-2025-55213 | Critical | 9.8 | 2025-08-18 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( ope… |
CVE-2025-48371 | High | 8.8 | 2025-05-22 | OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and doc… |
CVE-2025-46331 | Critical | 9.8 | 2025-04-30 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Hel… |
CVE-2025-25196 | Critical | 9.8 | 2025-02-19 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart <… |
CVE-2024-56323 | Critical | 9.8 | 2025-01-13 | OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnera… |
CVE-2024-42473 | High | 7.5 | 2024-08-12 | OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `… |
CVE-2024-31452 | High | 8.1 | 2024-04-16 | OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass wh… |
CVE-2024-23820 | Medium | 5.3 | 2024-01-26 | OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model… |
CVE-2023-45810 | Medium | 5.3 | 2023-10-17 | OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a de… |
CVE-2023-43645 | Medium | 5.9 | 2023-09-27 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when ce… |
CVE-2023-40579 | Medium | 6.5 | 2023-08-25 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable… |
CVE-2023-35933 | Medium | 5.9 | 2023-06-26 | OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and… |
CVE-2022-23542 | High | 7.7 | 2022-12-20 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered t… |
CVE-2022-39352 | Medium | 4.8 | 2022-11-08 | OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under… |
CVE-2022-39342 | Medium | 5.9 | 2022-10-25 | OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose mod… |
CVE-2022-39341 | Medium | 5.9 | 2022-10-25 | OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have… |
CVE-2022-39340 | Medium | 5.3 | 2022-10-25 | OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, result… |