-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openfga/openfga | go | <= 0.2.3 | 0.2.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of tupleset relations in authorization models. The commit diff shows critical changes in isUsersetRewriteValid where a new check was added to enforce that tupleset relations must use direct relationships (via reflect.TypeOf check against Userset_This). Prior to this fix, the function only checked existence of the relation, not its rewrite type. This allowed attackers to define tuplesets with computed usersets/unions/other rewrites, creating authorization bypass opportunities. The function's pre-patch behavior directly matches the vulnerability description of allowing non-direct tupleset relations.
A Semantic Attack on Google Gemini - Read the Latest Research