CyberRota Analysis
AI-GeneratedOpenFGA versions prior to 1.18.0 are vulnerable when using MySQL as the datastore, as they improperly handle case sensitivity in user strings, allowing distinct user identifiers to be treated as equivalent. This flaw can lead to unauthorized access, as different users may receive the same authorization response. Developers utilizing OpenFGA for permission management should prioritize upgrading to version 1.18.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)