CVE-2024-56323

What it actually does

Authorization bypass in Check and ListObjects API calls when models use conditions, caching is enabled, and contextual tuples containing conditions are supplied.

Why it matters to the business

Attackers may obtain unauthorized access decisions or object listings, resulting in data exposure or improper permission grants within applications relying on the authorization service.

How an attack unfolds

An attacker identifies an OpenFGA deployment using conditional models with caching enabled, then issues Check or ListObjects requests that include contextual tuples containing conditions; the cache mishandles these inputs and returns incorrect authorization results.

How to fix it

Upgrade OpenFGA to version 1.8.3 or later; the change is backward compatible. If immediate upgrade is not possible, disable check-query caching via OPENFGA_CHECK_QUERY_CACHE_ENABLED.

How to confirm the fix worked

Confirm the running version is 1.8.3 or newer; replay test Check and ListObjects calls that previously triggered the bypass and verify correct authorization results are returned.

Typical attack path

1. Scan for OpenFGA instances running versions 1.3.8 through 1.8.2 with caching enabled
2. Obtain or infer a model definition that uses conditions
3. Craft Check or ListObjects requests that supply contextual tuples containing conditions
4. Observe incorrect authorization decisions that grant access not permitted by policy

How to detect it

Review OpenFGA audit and request logs for Check and ListObjects API calls that contain contextual tuples and were processed while caching was enabled; look for repeated or anomalous authorization decisions on conditional models.

What your security team should do

• Upgrade all OpenFGA deployments to 1.8.3 immediately
• Audit logs for Check and ListObjects calls that include contextual tuples while caching was active
• Temporarily disable caching until patches are applied if risk is elevated
• Review models that use conditions for reliance on contextual tuples