CVE-2026-34972
Medium · 5.0CVSS
5.0
EPSS
0.3%
Published
Apr 6, 2026
CISA due date
—
The record
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | grafana-12.4 | 0 | 12.4.2-r3 |
| Wolfi | grafana-12.4 | 0 | 12.4.2-r3 |
Related vulnerabilities
- CVE-2026-33729 OpenFGA is a high-performance and flexible authorization/permission engine built for… Also affects grafana-12.4
- CVE-2026-32285 The Delete function fails to properly validate offsets when processing malformed JSON… Also affects grafana-12.4
- CVE-2026-21725 A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently… Also affects grafana-12.4
- CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
- CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863
- CVE-2026-96373 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863