CVE-2025-55213

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Aug 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-552146.9Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project CVE-2025-55227.3A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affec CVE-2025-552217.5A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 CVE-2025-552227.5A denial of service vulnerability exists in the Modbus TCP and Modbus RTU over TCP USB Function functionality of Socomec DIRIS Digiware M-70 CVE-2025-552237.0Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker CVE-2025-552247.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized at CVE-2025-552256.5Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a networ CVE-2025-552266.7Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker CVE-2025-552278.8Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate p CVE-2025-552287.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized at CVE-2025-552295.3Improper verification of cryptographic signature in Windows Certificates allows an unauthorized attacker to perform spoofing over a network.CVE-2025-55236.1A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file sr