5.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-46331

CVE-2025-46331: OpenFGA Authorization Bypass

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-46331

CVE-2025-46331:

5.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openfga/openfga	go	>= 1.3.6, < 1.8.11	1.8.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability occurs in OpenFGA when the check query cache is enabled and an authorization model contains a tuple cycle. Specifically, the Check and ListObjects APIs are affected. The provided commit 244302e7a8b979d66cc1874a3899cdff7d47862f modifies the internal/graph/cached_resolver.go file, specifically the ResolveCheck method of the CachedCheckResolver struct.

The vulnerability was that this ResolveCheck method would cache the response from the underlying resolver even if the response indicated that a cycle was detected (resp.GetCycleDetected()). A cycle means the result of the check is indeterminate at that point in the resolution. Caching such an indeterminate result (which might resolve to allowed: false due to the cycle) could then be served to subsequent identical Check or ListObjects requests (if ListObjects internally uses this check mechanism). This could lead to an authorization bypass if the true, fully resolved state (potentially by a parent check resolving differently due to the cycle information) should have been allowed: true.

The patch introduces a condition: if resp.GetCycleDetected() is true, the function logs the event and returns the response without saving it to the cache (c.cache.Set(...)). This ensures that indeterminate results due to cycles are not cached, forcing a re-evaluation by the underlying resolver for subsequent requests or allowing the calling context to correctly interpret the cycle. The primary vulnerable function identified is github.com/openfga/openfga/internal/graph.(*CachedCheckResolver).ResolveCheck because its previous behavior of caching cycle-detected results directly led to the vulnerability when used by the Check API (and potentially ListObjects API).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.