CVE-2026-24851

Unknown Unknown - Not Provided

Improper Policy Enforcement in OpenFGA Authorization Engine

Publication date: 2026-02-06

Last updated on: 2026-02-24

Assigner: GitHub, Inc.

Description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22<= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed. The vulnerability requires a model that has a a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access. This vulnerability is fixed in v1.11.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-06

Last Modified

2026-02-24

Generated

2026-07-06

AI Q&A

2026-02-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-24851

EUVD

EUVD-2026-5633

Affected Vendors & Products

Vendor	Product	Version / Range
openfga	helm_charts	From 0.2.22 (inc) to 0.2.51 (exc)
openfga	openfga	From 1.8.5 (inc) to 1.11.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenFGA versions 1.8.5 to 1.11.2 and involves improper policy enforcement during certain Check calls. It requires a specific model setup where a relation is assignable both by a type bound public access and a type bound non-public access, with tuples assigned under these conditions and involving objects with lexicographically larger IDs. This flaw can cause the authorization engine to incorrectly enforce permissions.

Impact Analysis

The vulnerability can lead to improper enforcement of authorization policies, potentially allowing unauthorized access or denial of access to resources. This means that users might gain permissions they should not have or be blocked from actions they are authorized to perform, undermining the security and integrity of the system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenFGA to version 1.11.3 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-24851. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70