-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing cycle detection in authorization model processing. Key API endpoints (Check/ListObjects) used typesystem.New without validation(), allowing circular relationships. The patch introduced typesystem.NewAndValidate with cycle detection and entrypoint validation(). The server.go handlers were vulnerable because they directly instantiated TypeSystem without validation(), while typesystem.New lacked critical safety checks for recursive model definitions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openfga/openfga | go | < 1.1.1 | 1.1.1 |