CVE-2022-39340

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users `openfga/openfga` versions 0.2.3 and prior who are exposing the OpenFGA service to the internet are vulnerable. Version 0.2.4 contains a patch for this issue.

• CWE-285
• CWE-862

• https://github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42fPatch, Third Party Advisory
• https://github.com/openfga/openfga/releases/tag/v0.2.4Release Notes, Third Party Advisory
• https://github.com/openfga/openfga/security/advisories/GHSA-95x7-mh78-7w2rThird Party Advisory
• https://github.com/openfga/openfga/commit/779d73d4b6d067ee042ec9b59fec707eed71e42fPatch, Third Party Advisory
• https://github.com/openfga/openfga/releases/tag/v0.2.4Release Notes, Third Party Advisory
• https://github.com/openfga/openfga/security/advisories/GHSA-95x7-mh78-7w2rThird Party Advisory

Published

Oct 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39334Nextcloud also ships a CLI utility called nextcloudcmd which…4.7
• CVE-2022-39335Synapse is an open-source Matrix homeserver written and main…5
• CVE-2022-39337Hertzbeat is an open source, real-time monitoring system wit…7.5
• CVE-2022-39338user_oidc is an OpenID Connect user backend for Nextcloud. V…5.4
• CVE-2022-39339user_oidc is an OpenID Connect user backend for Nextcloud. I…4.3
• CVE-2022-3934The FlatPM WordPress plugin before 3.0.13 does not sanitise …5.4
• CVE-2022-39341OpenFGA is an authorization/permission engine. Versions prio…9.8
• CVE-2022-39342OpenFGA is an authorization/permission engine. Versions prio…9.8
• CVE-2022-39343Azure RTOS FileX is a FAT-compatible file system that’s full…7.8
• CVE-2022-39344Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-39345Gin-vue-admin is a backstage management system based on vue …7.5
• CVE-2022-39346Nextcloud server is an open source personal cloud server. Af…6.5