{"id":"GHSA-m3q4-7qmj-657m","summary":"OpenFGA Authorization Bypass","details":"### Overview\nDuring our internal security assessment, it was discovered that OpenFGA versions v0.3.0 is vulnerable to authorization bypass under certain conditions.\n\n### Am I Affected?\nYou are affected by this vulnerability if **all** of the following applies:\n\n1.  You are using OpenFGA v0.3.0\n2. You created a model using modeling language v1.1 that applies a type restriction to an object e.g. `define viewer: [user]`\n3. You created tuples based on the aforementioned model, e.g. `document:1#viewer@user:jon`\n4. You updated the previous model by adding a new type and replacing the previous restriction with the newly added type e.g. `define viewer: [employee]`\n5. You use the tuples created against the first model (step 3) and issue checks against the updated model e.g. `user=user:jon, relation=viewer, object:document:1`\n\n### How to fix that?\nUpgrade to version v0.3.1\n\n### Backward Compatibility\nThis update is backward compatible.","aliases":["CVE-2022-23542","GO-2022-1179"],"modified":"2024-08-21T16:28:31.301605Z","published":"2022-12-20T19:33:27Z","database_specific":{"nvd_published_at":"2022-12-20T21:15:00Z","cwe_ids":["CWE-285"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-12-20T19:33:27Z"},"references":[{"type":"WEB","url":"https://github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23542"},{"type":"WEB","url":"https://github.com/openfga/openfga/pull/422"},{"type":"PACKAGE","url":"https://github.com/openfga/openfga"},{"type":"WEB","url":"https://github.com/openfga/openfga/releases/tag/v0.3.1"}],"affected":[{"package":{"name":"github.com/openfga/openfga","ecosystem":"Go","purl":"pkg:golang/github.com/openfga/openfga"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"},{"fixed":"0.3.1"}]}],"versions":["0.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-m3q4-7qmj-657m/GHSA-m3q4-7qmj-657m.json"}}],"schema_version":"1.9.0"}