CVE-2024-56323

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses [conditions](https://openfga.dev/docs/modeling/conditions), and 2. calling Check API or ListObjects API with [contextual tuples](https://openfga.dev/docs/concepts#what-are-contextual-tuples) that include conditions and 3. OpenFGA is configured with caching enabled (`OPENFGA_CHECK_QUERY_CACHE_ENABLED`). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-563247.1GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML config CVE-2024-563259.8Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Respo CVE-2024-563267.8Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format al CVE-2024-563279.8pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying CVE-2024-563286.1Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a CVE-2024-563298.9Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by La CVE-2024-56337.5Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the sa CVE-2024-563309.3Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. Th CVE-2024-563316.8Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitiv CVE-2024-563325.3Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and CVE-2024-563339.4Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environm CVE-2024-563347.8systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are pass