CVE-2025-64751

The record

### Overview OpenFGA v1.4.0 to v1.11.0 (openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. ### Am I Affected? You are affected by this vulnerability if you meet the following preconditions: - You are using OpenFGA v1.4.0 to v1.11.0 - The model has a a relation directly assignable by a [type bound pubic access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) with [condition](https://openfga.dev/docs/modeling/conditions) - The same relation is not assignable by a type bound public access without condition - You have a type assigned for the same relation that is a type bound public access without condition ### Fix Upgrade to v1.11.1. This upgrade is backwards compatible. ### Workaround None

Affected packages

Related vulnerabilities

• CVE-2026-24851 OpenFGA is a high-performance and flexible authorization/permission engine built for… Also affects github.com/openfga/openfga
• CVE-2025-11065 A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing… Also affects grafana-11.2-oci-compat
• CVE-2024-10452 Grafana org admin can delete pending invites in different org Also affects grafana-11.2-oci-compat
• CVE-2024-6485 A security vulnerability has been discovered in bootstrap that could enable Cross-Site… Also affects grafana-11.2-oci-compat
• CVE-2025-41115 Grafana Incorrect Privilege Assignment vulnerability Also affects grafana-12.0-oci-compat
• CVE-2026-27880 The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory… Also affects grafana-12.2
• CVE-2026-28375 A testdata data-source can be used to trigger out-of-memory crashes in Grafana. Also affects grafana-12.2
• CVE-2026-27879 A resample query can be used to trigger out-of-memory crashes in Grafana. Also affects grafana-12.2