CVE-2026-34972

Received Received - Intake

Improper Policy Enforcement in OpenFGA BatchCheck Calls

Publication date: 2026-04-06

Last updated on: 2026-04-20

Assigner: GitHub, Inc.

Description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-06

Last Modified

2026-04-20

Generated

2026-07-06

AI Q&A

2026-04-07

EPSS Evaluated

2026-07-05

NVD

CVE-2026-34972

EUVD

EUVD-2026-19486

Affected Vendors & Products

Vendor	Product	Version / Range
openfga	helm_charts	From 0.2.16 (inc) to 0.2.62 (exc)
openfga	openfga	From 1.8.0 (inc) to 1.14.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenFGA versions 1.8.0 to 1.13.1. Under specific conditions, when BatchCheck calls include multiple checks for the same object, relation, and user combination, it can lead to improper policy enforcement. Essentially, the authorization engine may not correctly enforce permissions, potentially allowing unauthorized access or actions.

Impact Analysis

The impact of this vulnerability is that it can cause improper enforcement of authorization policies. This means that users might gain access to resources or perform actions they are not permitted to, leading to potential data exposure, unauthorized modifications, or other security breaches.

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenFGA to version 1.14.0 or later, where the issue is fixed.

Hi! I’m here to help you understand CVE-2026-34972. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70