Description

OpenFGA Authorization Bypass

Overview

During our internal security assessment, it was discovered that OpenFGA versions v0.3.0 is vulnerable to authorization bypass under certain conditions.

Am I Affected?

You are affected by this vulnerability if all of the following applies:

You are using OpenFGA v0.3.0

You created a model using modeling language v1.1 that applies a type restriction to an object e.g. define viewer: [user]

You created tuples based on the aforementioned model, e.g. document:1#viewer@user:jon

You updated the previous model by adding a new type and replacing the previous restriction with the newly added type e.g. define viewer: [employee]

You use the tuples created against the first model (step 3) and issue checks against the updated model e.g. user=user:jon, relation=viewer, object:document:1

How to fix that?

Upgrade to version v0.3.1

Backward Compatibility

This update is backward compatible.

Mitigation

Aliases

References