OP
Vendor
openfga
39
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-61709 | OP openfga openfga | 5.3 | Sep 16 | OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user |
| CVE-2026-55689 | OP openfga openfga | 8.1 | Jul 9 | OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset |
| CVE-2026-55170 | OP openfga openfga | 5.4 | Jul 9 | OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions |
| CVE-2026-48096 | OP openfga openfga | 5.3 | Jun 10 | OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning |
| CVE-2026-41131 | OP openfga openfga | 5.0 | Apr 21 | OpenFGA has Improper Policy Enforcement |
| CVE-2026-40293 | OP openfga openfga | 6.5 | Apr 17 | OpenFGA Playground Preshared Key Exposure |
| CVE-2026-34972 | OP openfga openfga | 8.8 | Apr 6 | OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision |
| CVE-2026-33729 | OP openfga openfga | 9.8 | Mar 27 | OpenFGA has an Authorization Bypass through cached keys |
| CVE-2026-24851 | OP openfga openfga | 8.8 | Feb 6 | OpenFGA Improper Policy Enforcement |
| CVE-2025-64751 | OP openfga openfga | 8.8 | Nov 21 | OpenFGA Improper Policy Enforcement |
| CVE-2025-55213 | HC Helm Charts Openfga | 9.8 | Aug 18 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar |
| CVE-2025-48371 | HC Helm Charts Openfga | 8.8 | May 22 | OpenFGA is an authorization/permission engine |
| CVE-2025-46331 | HC Helm Charts Openfga | 9.8 | Apr 30 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar |
| CVE-2025-25196 | OP Openfga Openfga | 9.8 | Feb 19 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar |
| CVE-2024-56323 | HC Helm Charts Openfga | 9.8 | Jan 13 | OpenFGA is an authorization/permission engine |
| CVE-2024-42473 | OP Openfga Openfga | 9.8 | Aug 12 | OpenFGA is an authorization/permission engine |
| CVE-2024-31452 | OP Openfga Openfga | 9.8 | Apr 16 | OpenFGA is a high-performance and flexible authorization/permission engine |
| CVE-2024-23820 | OP Openfga Openfga | 6.5 | Jan 26 | OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3 |
| CVE-2023-45810 | OP Openfga Openfga | 7.5 | Oct 17 | OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar |
| CVE-2023-43645 | OP Openfga Openfga | 5.9 | Sep 27 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar |
| CVE-2023-40579 | OP Openfga Openfga | 6.5 | Aug 25 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar |
| CVE-2023-35933 | OP Openfga Openfga | 7.5 | Jun 26 | OPenFGA is an open source authorization/permission engine built for developers |
| CVE-2022-23542 | OP Openfga Openfga | 9.8 | Dec 20 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar |
| CVE-2022-39352 | OP Openfga Openfga | 9.8 | Nov 8 | OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar |
| CVE-2022-39341 | OP openfga openfga | 9.8 | Oct 25 | OpenFGA Authorization Bypass |
| CVE-2022-39342 | OP openfga openfga | 9.8 | Oct 25 | OpenFGA Authorization Bypass |
| CVE-2022-39340 | OP openfga openfga | 5.3 | Oct 25 | OpenFGA Information Disclosure |