CVE-2023-40579

MediumCVSS 6.5

Published: 25/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

36th percentile - higher than 36% of all known CVEs

Summary

OpenFGA is an authorization engine that is vulnerable to authorization bypass when calling the ListObjects API in version 1.3.0 or earlier. The issue affects users using models containing expressions of type rel1 from type1.

Risk Assessment

Organizations may be exposed to unauthorized access to resources, potentially leading to serious data security breaches.

Recommendation

It is recommended to upgrade OpenFGA to version 1.3.1 to mitigate this vulnerability.

Original NVD description (English source)

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using `ListObjects` with specific models. The affected models contain expressions of type `rel1 from type1`. This issue has been patched in version 1.3.1.