{"id":"CVE-2022-39352","published":"2022-11-08T00:00:00Z","modified":"2025-04-23T16:39:59Z","title":"OpenFGA Authorization Bypass","vendor":"openfga","product":"openfga","tier":"tail","description":{"text":"OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00457,"percentile":0.39639,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-3gfj-fxx4-f22w","tags":[]}],"priority":{"score":11.3,"factors":[{"name":"EPSS percentile","points":7.93},{"name":"CVSS severity","points":3.36}]},"vendorSlug":"openfga","affectedVersions":[{"vendor":"openfga","product":"openfga","versions":["< 0.2.5"]}],"affected":[{"ecosystem":"Go","package":"github.com/openfga/openfga","vulnerableRanges":["<0.2.5"],"patched":["0.2.5"],"from":["GHSA-3gfj-fxx4-f22w","GO-2022-1099"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7210","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-openfga-cve-2022-39352","children":[{"from":"CVE-2022-39352","to":"CVE-2023-35933","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/typesystem/typesystem.go"],"commits":["https://github.com/openfga/openfga/commit/776e80505e8d184b2286acc8268d8d74f36a9984","https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452"],"basis":"shared function","functions":["isUsersetRewriteValid"]}]},{"from":"CVE-2022-39352","to":"CVE-2023-43645","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/typesystem/typesystem.go"],"commits":["https://github.com/openfga/openfga/commit/776e80505e8d184b2286acc8268d8d74f36a9984","https://github.com/openfga/openfga/commit/725296025fd81227c89525808652c6acd4a605f6"],"basis":"shared function","functions":["InvalidRelationTypeError"]}]}],"packageHistory":[{"cve":"CVE-2022-39340","published":"2022-10-25","fixed":"0.2.4","kev":false,"link":{"from":"CVE-2022-39340","to":"CVE-2022-39352","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/openfga/openfga","fromFixed":"0.2.4","toFixed":"0.2.5","daysApart":14}]}},{"cve":"CVE-2022-39341","published":"2022-10-25","fixed":"0.2.4","kev":false},{"cve":"CVE-2022-39342","published":"2022-10-25","fixed":"0.2.4","kev":false},{"cve":"CVE-2022-39352","published":"2022-11-08","fixed":"0.2.5","kev":false},{"cve":"CVE-2022-23542","published":"2022-12-20","fixed":"0.3.1","kev":false},{"cve":"CVE-2023-35933","published":"2023-06-26","fixed":"1.1.1","kev":false},{"cve":"CVE-2023-40579","published":"2023-08-25","fixed":"1.3.1","kev":false}],"package":"Go:github.com/openfga/openfga"}}