Executive brief
OpenFGA is an authorization engine used by developers to manage user permissions and access control within applications. A vulnerability in certain versions could allow improper policy enforcement when processing multiple permission checks simultaneously. This means a user might be granted access they should not have, or denied access they should have, potentially leading to unauthorized data access or service disruption.
Technical details
An improper authorization vulnerability (CWE-863) exists in OpenFGA's BatchCheck implementation. When multiple checks within a single BatchCheck operation target the same user, object, and relation combination but provide different context data, the engine may fail to enforce policies correctly. This occurs because the engine may incorrectly reuse or mishandle the context across these overlapping checks. An attacker with low privileges could potentially exploit this to bypass intended access restrictions. The issue affects OpenFGA versions 1.8.0 through 1.13.1 and is resolved in version 1.14.0.
Affected products
- OpenFGA OpenFGA >= 1.8.0, < 1.14.0
- OpenFGA OpenFGA Helm Chart >= 0.2.16, < 0.2.62
Timeline
- 2026-04-06: disclosed
- 2026-04-06: advisory
- 2026-04-06: patched