CVE-2025-25196

描述

Overview OpenFGA v1.8.4 or previous (Helm chart < openfga-0.2.22, docker < v.1.8.5) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Am I Affected? If you are using OpenFGA v1.8.4 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability: - Calling Check API or ListObjects with a model that has a relation [directly assignable](https://openfga.dev/docs/concepts#what-is-a-directly-related-user-type) to both [public access](https://openfga.dev/docs/concepts#what-is-type-bound-public-access) AND [userset](https://openfga.dev/docs/concepts#what-is-a-user) with the [same type](https://openfga.dev/docs/concepts#what-is-a-type), and - A type bound public access tuple is assigned to an object, and - userset tuple is not assigned to the same object, and - Check request's user field is a userset that has the same type as the type bound public access tuple's user type Fix Upgrade to v1.8.5. This upgrade is backwards compatible.

受影響套件(2)

• Go/github.com/openfga/openfgafrom 0, < 1.8.5
• Go/github.com/openfga/openfgafrom 0, < 1.8.5

CVSS 分數

參考連結(4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-25196
• PATCHhttps://github.com/openfga/openfga
• WEBhttps://github.com/openfga/openfga/commit/0aee4f47e0c642de78831ceb27bb62b116f49588
• WEBhttps://github.com/openfga/openfga/security/advisories/GHSA-g4v5-6f5p-m38j