CVE-2025-46331

What it actually does

Authorization bypass in OpenFGA allowing certain Check and ListObject API calls to return incorrect authorization decisions.

Why it matters to the business

Attackers may gain unauthorized access to protected resources or data, increasing breach risk and compliance violations in environments using OpenFGA for access control.

How an attack unfolds

An attacker sends specially crafted Check or ListObject requests to a vulnerable OpenFGA instance (<=1.8.10) that exploit the authorization logic flaw to obtain false-positive allow decisions without proper permission checks.

How to fix it

Upgrade OpenFGA to the fixed commit 244302e7a8b979d66cc1874a3899cdff7d47862f or later; for Red Hat Enterprise Linux 8 appstream packages upgrade to aspnetcore-runtime-6.0-0:6.0.24-1.el8_8 and equivalent dotnet packages listed in the advisory.

How to confirm the fix worked

Confirm deployed OpenFGA version is newer than 1.8.10 or contains commit 244302e7a8b979d66cc1874a3899cdff7d47862f; re-run affected Check and ListObject test cases to verify correct deny responses.

Typical attack path

1. Identify publicly reachable OpenFGA deployment running version 1.8.10 or earlier
2. Craft and send malicious Check or ListObject API calls targeting specific objects or relations
3. Receive unauthorized allow responses that bypass intended access controls
4. Use granted access to read, list, or operate on protected resources

How to detect it

Inspect application and API gateway logs for high volumes or anomalous patterns of Check and ListObject calls; correlate with authorization decision logs showing unexpected allow results.

What your security team should do

• Immediately upgrade all OpenFGA instances to the fixed commit
• Review and tighten API access controls around Check and ListObject endpoints until patched
• Monitor for unusual volumes of Check/ListObject requests in application logs
• Audit recent authorization decisions for potential unauthorized access patterns