Improper authorization control for web services In github.com/openfga/openfga
Description
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint
Overview
During our internal security assessment, it was discovered that streamed-list-objects endpoint was not validating the authorization header resulting in the disclosure of objects in the store.
Am I Affected?
You are affected by this vulnerability if you are using openfga/openfga version v0.2.3 or prior and you are exposing the OpenFGA service to the internet.
How to fix that?
Upgrade to version v0.2.4.
Backward Compatibility
This update is backward compatible.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 go | 0.2.4 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.