CVE-2023-35933

OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.

• CWE-835

• https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452Patch
• https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8jVendor Advisory
• https://openfga.dev/api/service#/Relationship%20Queries/CheckExploit, Vendor Advisory
• https://openfga.dev/api/service#/Relationship%20Queries/ListObjectsExploit, Vendor Advisory
• https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452Patch
• https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8jVendor Advisory
• https://openfga.dev/api/service#/Relationship%20Queries/CheckExploit, Vendor Advisory
• https://openfga.dev/api/service#/Relationship%20Queries/ListObjectsExploit, Vendor Advisory

Published

Jun 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35928Nextcloud Server is a space for data storage on Nextcloud, a…8.8
• CVE-2023-35929Tuleap is a free and open source suite to improve management…5.4
• CVE-2023-3593Mattermost fails to properly validate markdown, allowing an …6.5
• CVE-2023-35930SpiceDB is an open source, Google Zanzibar-inspired, databas…5.3
• CVE-2023-35931Shescape is a simple shell escape library for JavaScript. An…4.3
• CVE-2023-35932jcvi is a Python library to facilitate genome assembly, anno…8.8
• CVE-2023-35934yt-dlp is a command-line program to download videos from vid…8.2
• CVE-2023-35935Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-35936Pandoc is a Haskell library for converting from one markup f…5
• CVE-2023-35937Metersphere is an open source continuous testing platform. I…8.8
• CVE-2023-35938 Tuleap is a Free & Open Source Suite to improve management …7.2
• CVE-2023-35939GLPI is a free asset and IT management software package. Sta…8.1