CVE-2022-39341

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard (`*`) defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue.

• CWE-285

• https://github.com/openfga/openfga/commit/b466769cc100b2065047786578718d313f52695bPatch, Third Party Advisory
• https://github.com/openfga/openfga/releases/tag/v0.2.4Release Notes, Third Party Advisory
• https://github.com/openfga/openfga/security/advisories/GHSA-vj4m-83m8-xpw5Third Party Advisory
• https://github.com/openfga/openfga/commit/b466769cc100b2065047786578718d313f52695bPatch, Third Party Advisory
• https://github.com/openfga/openfga/releases/tag/v0.2.4Release Notes, Third Party Advisory
• https://github.com/openfga/openfga/security/advisories/GHSA-vj4m-83m8-xpw5Third Party Advisory

Published

Oct 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39335Synapse is an open-source Matrix homeserver written and main…5
• CVE-2022-39337Hertzbeat is an open source, real-time monitoring system wit…7.5
• CVE-2022-39338user_oidc is an OpenID Connect user backend for Nextcloud. V…5.4
• CVE-2022-39339user_oidc is an OpenID Connect user backend for Nextcloud. I…4.3
• CVE-2022-3934The FlatPM WordPress plugin before 3.0.13 does not sanitise …5.4
• CVE-2022-39340OpenFGA is an authorization/permission engine. Prior to vers…5.3
• CVE-2022-39342OpenFGA is an authorization/permission engine. Versions prio…9.8
• CVE-2022-39343Azure RTOS FileX is a FAT-compatible file system that’s full…7.8
• CVE-2022-39344Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-39345Gin-vue-admin is a backstage management system based on vue …7.5
• CVE-2022-39346Nextcloud server is an open source personal cloud server. Af…6.5
• CVE-2022-39347FreeRDP is a free remote desktop protocol library and client…5.7