openfga records

26 published records for vendor openfga.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

26 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-23542No exploit	OpenFGA Authorization Bypassopenfga · openfga · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.8	—	1.0%	Dec 20, 2022
39Monitor	CVE-2022-39341No exploit	OpenFGA Authorization Bypassopenfga · openfga · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.8	—	1.0%	Oct 25, 2022
39Monitor	CVE-2022-39342No exploit	OpenFGA Authorization Bypassopenfga · openfga · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.8	—	1.0%	Oct 25, 2022
39Monitor	CVE-2024-31452No exploit	OpenFGA Authorization Bypassopenfga · openfga · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.7%	Apr 16, 2024
39Monitor	CVE-2024-42473No exploit	OpenFGA Authorization Bypassopenfga · openfga · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Aug 12, 2024
39Monitor	CVE-2022-39352No exploit	OpenFGA Authorization Bypassopenfga · openfga · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.4%	Nov 8, 2022
35Monitor	CVE-2026-34972No exploit	OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collisionopenfga · helm charts · CWE-863 Broken access control (IDOR)	High8.8	—	0.3%	Apr 6, 2026
32Monitor	CVE-2026-55689No exploit	OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unsetopenfga · helm charts · CWE-287 Auth bypass	High8.1	—	0.4%	Jul 9, 2026
30Monitor	CVE-2023-35933No exploit	OpenFGA denial of service die to circular relationshipopenfga · openfga · CWE-835 Pre-auth Denial of service	High7.5	—	1.1%	Jun 26, 2023
30Monitor	CVE-2023-45810No exploit	OpenFGA denial of serviceopenfga · openfga · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 17, 2023
26Monitor	CVE-2024-23820No exploit	OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3.openfga · openfga · CWE-770 Denial of service	Medium6.5	—	0.7%	Jan 26, 2024
26Monitor	CVE-2023-40579No exploit	OpenFGA Authorization Bypassopenfga · openfga · CWE-284 Broken access control (IDOR)	Medium6.5	—	0.5%	Aug 25, 2023
26Monitor	CVE-2026-40293No exploit	OpenFGA Playground Preshared Key Exposureopenfga · openfga · CWE-200 Pre-auth Info leak	Medium6.5	—	0.5%	Apr 17, 2026
23Monitor	CVE-2023-43645No exploit	Denial of service from circular relationship definitions in OpenFGAopenfga · openfga · CWE-835 Pre-auth Denial of service	Medium5.9	—	0.9%	Sep 27, 2023
23Monitor	CVE-2025-48371No exploit	OpenFGA Authorization Bypassopenfga · helm charts · CWE-285 Broken access control (IDOR)	Medium5.8	—	0.5%	May 22, 2025
23Monitor	CVE-2024-56323No exploit	OpenFGA Authorization Bypassopenfga · helm charts · CWE-285 Broken access control (IDOR)	Medium5.8	—	0.4%	Jan 13, 2025
23Monitor	CVE-2025-25196No exploit	OpenFGA Authorization Bypassopenfga · helm charts · CWE-285 Broken access control (IDOR)	Medium5.8	—	0.4%	Feb 19, 2025
23Monitor	CVE-2025-46331No exploit	OpenFGA Authorization Bypassopenfga · helm charts · CWE-284 Broken access control (IDOR)	Medium5.8	—	0.4%	Apr 30, 2025
23Monitor	CVE-2026-24851No exploit	OpenFGA Improper Policy Enforcementopenfga · helm charts · CWE-863 Broken access control (IDOR)	Medium5.8	—	0.3%	Feb 6, 2026
23Monitor	CVE-2025-55213No exploit	OpenFGA Authorization Bypass (Check)openfga · helm charts · CWE-863 Broken access control (IDOR)	Medium5.8	—	0.3%	Aug 18, 2025
23Monitor	CVE-2026-33729No exploit	OpenFGA has an Authorization Bypass through cached keysopenfga · openfga · CWE-20	Medium5.8	—	0.3%	Mar 26, 2026
23Monitor	CVE-2025-64751No exploit	OpenFGA Improper Policy Enforcementopenfga · helm charts · CWE-285 Broken access control (IDOR)	Medium5.8	—	0.3%	Nov 20, 2025
21Monitor	CVE-2022-39340No exploit	OpenFGA Information Disclosureopenfga · openfga · CWE-285 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.8%	Oct 25, 2022
21Monitor	CVE-2026-48096No exploit	OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoningopenfga · helm charts · CWE-345 Pre-auth	Medium5.3	—	0.1%	Jun 10, 2026
20Monitor	CVE-2026-41131No exploit	OpenFGA has Improper Policy Enforcementopenfga · helm charts · CWE-706	Medium5.0	—	0.2%	Apr 21, 2026

CVE-2022-23542
39Monitor
OpenFGA Authorization Bypass
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
openfga · openfgaDec 20, 2022
CVE-2022-39341
39Monitor
OpenFGA Authorization Bypass
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
openfga · openfgaOct 25, 2022
CVE-2022-39342
39Monitor
OpenFGA Authorization Bypass
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
openfga · openfgaOct 25, 2022
CVE-2024-31452
39Monitor
OpenFGA Authorization Bypass
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
openfga · openfgaApr 16, 2024
CVE-2024-42473
39Monitor
OpenFGA Authorization Bypass
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
openfga · openfgaAug 12, 2024
CVE-2022-39352
39Monitor
OpenFGA Authorization Bypass
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
openfga · openfgaNov 8, 2022
CVE-2026-34972
35Monitor
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
openfga · helm chartsApr 6, 2026
CVE-2026-55689
32Monitor
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
openfga · helm chartsJul 9, 2026
CVE-2023-35933
30Monitor
OpenFGA denial of service die to circular relationship
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
openfga · openfgaJun 26, 2023
CVE-2023-45810
30Monitor
OpenFGA denial of service
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
openfga · openfgaOct 17, 2023
CVE-2024-23820
26Monitor
OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3.
MediumCVSS 6.5No exploitEPSS 1%
- Denial of service
openfga · openfgaJan 26, 2024
CVE-2023-40579
26Monitor
OpenFGA Authorization Bypass
MediumCVSS 6.5No exploitEPSS 1%
- Broken access control (IDOR)
openfga · openfgaAug 25, 2023
CVE-2026-40293
26Monitor
OpenFGA Playground Preshared Key Exposure
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
- Info leak
openfga · openfgaApr 17, 2026
CVE-2023-43645
23Monitor
Denial of service from circular relationship definitions in OpenFGA
MediumCVSS 5.9No exploitEPSS 1%
- Pre-auth
- Denial of service
openfga · openfgaSep 27, 2023
CVE-2025-48371
23Monitor
OpenFGA Authorization Bypass
MediumCVSS 5.8No exploitEPSS 0%
- Broken access control (IDOR)
openfga · helm chartsMay 22, 2025
CVE-2024-56323
23Monitor
OpenFGA Authorization Bypass
MediumCVSS 5.8No exploitEPSS 0%
- Broken access control (IDOR)
openfga · helm chartsJan 13, 2025
CVE-2025-25196
23Monitor
OpenFGA Authorization Bypass
MediumCVSS 5.8No exploitEPSS 0%
- Broken access control (IDOR)
openfga · helm chartsFeb 19, 2025
CVE-2025-46331
23Monitor
OpenFGA Authorization Bypass
MediumCVSS 5.8No exploitEPSS 0%
- Broken access control (IDOR)
openfga · helm chartsApr 30, 2025
CVE-2026-24851
23Monitor
OpenFGA Improper Policy Enforcement
MediumCVSS 5.8No exploitEPSS 0%
- Broken access control (IDOR)
openfga · helm chartsFeb 6, 2026
CVE-2025-55213
23Monitor
OpenFGA Authorization Bypass (Check)
MediumCVSS 5.8No exploitEPSS 0%
- Broken access control (IDOR)
openfga · helm chartsAug 18, 2025
CVE-2026-33729
23Monitor
OpenFGA has an Authorization Bypass through cached keys
MediumCVSS 5.8No exploitEPSS 0%
openfga · openfgaMar 26, 2026
CVE-2025-64751
23Monitor
OpenFGA Improper Policy Enforcement
MediumCVSS 5.8No exploitEPSS 0%
- Broken access control (IDOR)
openfga · helm chartsNov 20, 2025
CVE-2022-39340
21Monitor
OpenFGA Information Disclosure
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
openfga · openfgaOct 25, 2022
CVE-2026-48096
21Monitor
OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
openfga · helm chartsJun 10, 2026
CVE-2026-41131
20Monitor
OpenFGA has Improper Policy Enforcement
MediumCVSS 5.0No exploitEPSS 0%
openfga · helm chartsApr 21, 2026