Executive Summary

This vulnerability affects OpenFGA, an authorization and permission engine. Before version 1.14.1, when models used conditions with caching enabled, two different check requests could produce the same cache key. This means OpenFGA might reuse a cached result from an earlier request for a different subsequent request, potentially leading to incorrect authorization decisions.

The issue occurs only if the model has relations that rely on condition evaluation and caching is enabled by the user. The problem was fixed in OpenFGA version 1.14.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing OpenFGA to return incorrect authorization results due to cache reuse. Specifically, a permission check might incorrectly allow or deny access because it used a cached response from a different request.

Such incorrect authorization decisions can lead to unauthorized access or denial of legitimate access, potentially compromising the security and functionality of applications relying on OpenFGA for permission management.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenFGA to version 1.14.1 or later, as this version contains the fix addressing the caching issue.

Additionally, review your models to identify if they use relations relying on condition evaluation with caching enabled, as these are the preconditions for the vulnerability.

Useful 0 Not Useful 0