Description

A flaw was found in OpenFGA, an authorization/permission engine. When using MySQL as the datastore, and authorization decisions depend on case-sensitive user strings, the system may incorrectly treat case-distinct values (e.g., 'user:Alice' and 'user:alice') as equivalent. This can lead to improper policy enforcement, where two different authorization requests might receive the same, unintended response, potentially affecting access controls.

Mitigation

Aliases

References