CVE-2026-24851
Unknown Unknown - Not Provided
Improper Policy Enforcement in OpenFGA Authorization Engine

Publication date: 2026-02-06

Last updated on: 2026-02-24

Assigner: GitHub, Inc.

Description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22<= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed. The vulnerability requires a model that has a a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access. This vulnerability is fixed in v1.11.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-06
Last Modified
2026-02-24
Generated
2026-06-16
AI Q&A
2026-02-06
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24851
EUVD
EUVD-2026-5633
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
openfga helm_charts From 0.2.22 (inc) to 0.2.51 (exc)
openfga openfga From 1.8.5 (inc) to 1.11.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects OpenFGA versions 1.8.5 to 1.11.2 and involves improper policy enforcement during certain Check calls. It requires a specific model setup where a relation is assignable both by a type bound public access and a type bound non-public access, with tuples assigned under these conditions and involving objects with lexicographically larger IDs. This flaw can cause the authorization engine to incorrectly enforce permissions.

Impact Analysis

The vulnerability can lead to improper enforcement of authorization policies, potentially allowing unauthorized access or denial of access to resources. This means that users might gain permissions they should not have or be blocked from actions they are authorized to perform, undermining the security and integrity of the system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenFGA to version 1.11.3 or later, where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart