Overview
During our internal security assessment, it was discovered that OpenFGA versions v0.3.0 is vulnerable to authorization bypass under certain conditions.
Am I Affected?
You are affected by this vulnerability if all of the following applies:
- You are using OpenFGA v0.3.0
- You created a model using modeling language v1.1 that applies a type restriction to an object e.g.
define viewer: [user] - You created tuples based on the aforementioned model, e.g.
document:1#viewer@user:jon - You updated the previous model by adding a new type and replacing the previous restriction with the newly added type e.g.
define viewer: [employee] - You use the tuples created against the first model (step 3) and issue checks against the updated model e.g.
user=user:jon, relation=viewer, object:document:1
How to fix that?
Upgrade to version v0.3.1
Backward Compatibility
This update is backward compatible.