CVE-2026-34972
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
OpenFGA, a high-performance authorization/permission engine, has a vulnerability in BatchCheck calls where multiple checks for the same object, relation, and user combination can result in improper policy enforcement. This affects versions 1.8.0 to 1.13.1.
Risk Assessment
Improper policy enforcement can lead to unauthorized access to resources or violation of security policies.
Recommendation
It is recommended to update OpenFGA to version 1.14.0 or later, which includes the fix.
Original NVD description (English source)
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.