CVE-2026-34972
Received Received - Intake
Improper Policy Enforcement in OpenFGA BatchCheck Calls

Publication date: 2026-04-06

Last updated on: 2026-04-20

Assigner: GitHub, Inc.

Description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-06
Last Modified
2026-04-20
Generated
2026-06-16
AI Q&A
2026-04-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-34972
EUVD
EUVD-2026-19486
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
openfga helm_charts From 0.2.16 (inc) to 0.2.62 (exc)
openfga openfga From 1.8.0 (inc) to 1.14.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenFGA versions 1.8.0 to 1.13.1. Under specific conditions, when BatchCheck calls include multiple checks for the same object, relation, and user combination, it can lead to improper policy enforcement. Essentially, the authorization engine may not correctly enforce permissions, potentially allowing unauthorized access or actions.

Impact Analysis

The impact of this vulnerability is that it can cause improper enforcement of authorization policies. This means that users might gain access to resources or perform actions they are not permitted to, leading to potential data exposure, unauthorized modifications, or other security breaches.

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenFGA to version 1.14.0 or later, where the issue is fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart