CVE-2026-24851

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22<= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed. The vulnerability requires a model that has a a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access. This vulnerability is fixed in v1.11.3.

• CWE-863

• https://github.com/openfga/openfga/releases/tag/v1.11.3Release Notes
• https://github.com/openfga/openfga/security/advisories/GHSA-jq9f-gm9w-rwm9Vendor Advisory

Published

Feb 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24846malcontent discovers supply-chain compromises through. conte…5
• CVE-2026-24847OpenEMR is a free and open source electronic health records …6.1
• CVE-2026-24848OpenEMR is a free and open source electronic health records …9.9
• CVE-2026-24849OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-2485IBM Infosphere Information Server 11.7.0.0 through 11.7.1.6 …4.8
• CVE-2026-24850The ML-DSA crate is a Rust implementation of the Module-Latt…5.3
• CVE-2026-24852iccDEV provides a set of libraries and tools that allow for …8.1
• CVE-2026-24853Caido is a web security auditing toolkit. Prior to 0.55.0, C…9.8
• CVE-2026-24854ChurchCRM is an open-source church management system. A SQL …8.8
• CVE-2026-24855ChurchCRM is an open-source church management system. Versio…5.4
• CVE-2026-24856iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-24857`bulk_extractor` is a digital forensics exploitation tool. S…9.8