CVE-2025-48371: OpenFGA Authorization Bypass

The vulnerability lies in the CombinedTupleReader.ReadUsersetTuples method, which is responsible for reading userset tuples, including contextual tuples. The provided commit e5960d4eba92b723de8ff3a5346a07f50c1379ca directly addresses this by modifying the filtering logic within ReadUsersetTuples.

The patch introduces a new helper function tupleMatchesAllowedUserTypeRestrictions and calls it within ReadUsersetTuples to ensure that contextual tuples are filtered according to the AllowedUserTypeRestrictions specified in the query. Before this change, the code only checked if the user part of a contextual tuple was a UserSet (if tuple.GetUserTypeFromUser(t.GetKey().GetUser()) == tuple.UserSet) without properly validating against the specific type restrictions (e.g., wildcard vs. direct relation). This lack of precise filtering allowed for an authorization bypass under the conditions described in the advisory: when a model has a relationship assignable by both type-bound public access and a userset, and a contextual tuple with a userset is provided for that relationship, but type-bound public access tuples are not assigned. In such cases, the overly permissive filtering in ReadUsersetTuples could lead to incorrect authorization decisions. The Check and ListObjects APIs, mentioned as affected in the advisory, would rely on this underlying tuple reading mechanism, making ReadUsersetTuples the core vulnerable function whose incorrect behavior leads to the bypass.