{"id":"CVE-2025-55213","summary":"OpenFGA Authorization Bypass (Check)","details":"OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 \u003c= Helm chart \u003c= openfga-0.2.41, v1.9.3 \u003c= docker \u003c= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.","aliases":["GHSA-mgh9-4mwp-fg55","GO-2025-3894"],"modified":"2026-08-12T03:51:42.616366762Z","published":"2025-08-18T19:23:33.684Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55213.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-863"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55213.json"},{"type":"ADVISORY","url":"https://github.com/openfga/openfga/security/advisories/GHSA-mgh9-4mwp-fg55"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55213"},{"type":"FIX","url":"https://github.com/openfga/openfga/commit/1a7e0e37fc4777c824b2386cac4867a66f3480b0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openfga/helm-charts","events":[{"introduced":"87c202e20a7a0a36d21b06461f28bf7c3e4fe19e"},{"fixed":"30f74d8ef3a38e7e6b3d219b1a11b63bee94473f"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:openfga:helm_charts:*:*:*:*:*:openfga:*:*","extracted_events":[{"introduced":"0.2.40"},{"fixed":"0.2.42"}]}},{"type":"GIT","repo":"https://github.com/openfga/openfga","events":[{"introduced":"29a0aac987d121d37a7bd293a026b9521a8d6b24"},{"fixed":"06115c523f974d385896b159a60fe6e12c41e57d"},{"fixed":"1a7e0e37fc4777c824b2386cac4867a66f3480b0"}],"database_specific":{"cpe":"cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.9.3"},{"fixed":"1.9.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["openfga-0.2.41","openfga-0.2.40","v1.9.4","v1.9.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55213.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}