{"id":"CVE-2026-41131","aliases":["GHSA-57j5-qwp2-vqp6","GO-2026-5136"],"title":"OpenFGA has Improper Policy Enforcement","summary":"OpenFGA has Improper Policy Enforcement","severity":"medium","cvss":5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","vendor":"openfga","product":"github.com/openfga/openfga","ecosystem":"go","affected":["github.com/openfga/openfga < 1.14.1"],"patched":["github.com/openfga/openfga 1.14.1"],"published":"2026-04-22","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:42.824662710Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-57j5-qwp2-vqp6","references":[{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41131"},{"url":"https://github.com/openfga/openfga"},{"url":"https://github.com/openfga/openfga/releases/tag/v1.14.1"}],"tags":["osv","go"],"epss":0.00145,"epssPercentile":0.04142,"ingestedAt":"2026-07-09T18:56:37.052Z","slug":"CVE-2026-41131","body":"## Overview\n\n### Description\nIn OpenFGA, in specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This could result in OpenFGA reusing an earlier cached result for a subsequent request.\n\n### Am I Affected?\nUsers are affected if their applications meet the following preconditions:\n\n* The model has relations which rely on condition evaluation.\n* Caching is enabled.\n\n### Fix\nUpgrade to OpenFGA v1.14.1.\n\n### Acknowledgement\nOpenFGA would like to thank @bugbunny-research for the detailed report.\n\n## Affected packages\n\n- `github.com/openfga/openfga < 1.14.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/openfga/openfga 1.14.1`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201629,"id":"CVE-2026-41131","ts":1789399558881,"field":"cvss","old":null,"new":"5"},{"seq":201628,"id":"CVE-2026-41131","ts":1789399558881,"field":"severity","old":"none","new":"medium"},{"seq":200361,"id":"CVE-2026-41131","ts":1789397167223,"field":"cvss","old":"5","new":null},{"seq":200360,"id":"CVE-2026-41131","ts":1789397167223,"field":"severity","old":"medium","new":"none"},{"seq":198285,"id":"CVE-2026-41131","ts":1789391800584,"field":"cvss","old":null,"new":"5"},{"seq":198284,"id":"CVE-2026-41131","ts":1789391800584,"field":"severity","old":"none","new":"medium"},{"seq":196078,"id":"CVE-2026-41131","ts":1789383451569,"field":"cvss","old":"5","new":null},{"seq":196077,"id":"CVE-2026-41131","ts":1789383451569,"field":"severity","old":"medium","new":"none"},{"seq":195007,"id":"CVE-2026-41131","ts":1789380344246,"field":"cvss","old":null,"new":"5"},{"seq":195006,"id":"CVE-2026-41131","ts":1789380344246,"field":"severity","old":"none","new":"medium"},{"seq":193794,"id":"CVE-2026-41131","ts":1789378317684,"field":"cvss","old":"5","new":null},{"seq":193793,"id":"CVE-2026-41131","ts":1789378317684,"field":"severity","old":"medium","new":"none"},{"seq":192581,"id":"CVE-2026-41131","ts":1789376288416,"field":"cvss","old":null,"new":"5"},{"seq":192580,"id":"CVE-2026-41131","ts":1789376288416,"field":"severity","old":"none","new":"medium"},{"seq":191368,"id":"CVE-2026-41131","ts":1789373181814,"field":"cvss","old":"5","new":null},{"seq":191367,"id":"CVE-2026-41131","ts":1789373181814,"field":"severity","old":"medium","new":"none"},{"seq":190153,"id":"CVE-2026-41131","ts":1789369162185,"field":"cvss","old":null,"new":"5"},{"seq":190152,"id":"CVE-2026-41131","ts":1789369162185,"field":"severity","old":"none","new":"medium"},{"seq":188940,"id":"CVE-2026-41131","ts":1789368066794,"field":"cvss","old":"5","new":null},{"seq":188939,"id":"CVE-2026-41131","ts":1789368066794,"field":"severity","old":"medium","new":"none"},{"seq":187723,"id":"CVE-2026-41131","ts":1789365035745,"field":"cvss","old":null,"new":"5"},{"seq":187722,"id":"CVE-2026-41131","ts":1789365035745,"field":"severity","old":"none","new":"medium"},{"seq":186510,"id":"CVE-2026-41131","ts":1789363059295,"field":"cvss","old":"5","new":null},{"seq":186509,"id":"CVE-2026-41131","ts":1789363059295,"field":"severity","old":"medium","new":"none"},{"seq":185296,"id":"CVE-2026-41131","ts":1789360995183,"field":"cvss","old":null,"new":"5"},{"seq":185295,"id":"CVE-2026-41131","ts":1789360995183,"field":"severity","old":"none","new":"medium"},{"seq":184083,"id":"CVE-2026-41131","ts":1789357989665,"field":"cvss","old":"5","new":null},{"seq":184082,"id":"CVE-2026-41131","ts":1789357989665,"field":"severity","old":"medium","new":"none"},{"seq":182335,"id":"CVE-2026-41131","ts":1789354137420,"field":"cvss","old":null,"new":"5"},{"seq":182334,"id":"CVE-2026-41131","ts":1789354137420,"field":"severity","old":"none","new":"medium"},{"seq":181128,"id":"CVE-2026-41131","ts":1789352986338,"field":"cvss","old":"5","new":null},{"seq":181127,"id":"CVE-2026-41131","ts":1789352986338,"field":"severity","old":"medium","new":"none"},{"seq":179921,"id":"CVE-2026-41131","ts":1789350049281,"field":"cvss","old":null,"new":"5"},{"seq":179920,"id":"CVE-2026-41131","ts":1789350049281,"field":"severity","old":"none","new":"medium"},{"seq":178714,"id":"CVE-2026-41131","ts":1789347902113,"field":"cvss","old":"5","new":null},{"seq":178713,"id":"CVE-2026-41131","ts":1789347902113,"field":"severity","old":"medium","new":"none"},{"seq":177507,"id":"CVE-2026-41131","ts":1789346203506,"field":"cvss","old":null,"new":"5"},{"seq":177506,"id":"CVE-2026-41131","ts":1789346203506,"field":"severity","old":"none","new":"medium"},{"seq":176300,"id":"CVE-2026-41131","ts":1789342805340,"field":"cvss","old":"5","new":null},{"seq":176299,"id":"CVE-2026-41131","ts":1789342805340,"field":"severity","old":"medium","new":"none"},{"seq":175754,"id":"CVE-2026-41131","ts":1789338592290,"field":"cvss","old":null,"new":"5"},{"seq":175753,"id":"CVE-2026-41131","ts":1789338592290,"field":"severity","old":"none","new":"medium"},{"seq":175624,"id":"CVE-2026-41131","ts":1789338430169,"field":"cvss","old":"5","new":null},{"seq":175623,"id":"CVE-2026-41131","ts":1789338430169,"field":"severity","old":"medium","new":"none"},{"seq":174419,"id":"CVE-2026-41131","ts":1789334636504,"field":"cvss","old":null,"new":"5"},{"seq":174418,"id":"CVE-2026-41131","ts":1789334636504,"field":"severity","old":"none","new":"medium"},{"seq":173214,"id":"CVE-2026-41131","ts":1789333278745,"field":"cvss","old":"5","new":null},{"seq":173213,"id":"CVE-2026-41131","ts":1789333278745,"field":"severity","old":"medium","new":"none"},{"seq":172028,"id":"CVE-2026-41131","ts":1789330922432,"field":"cvss","old":null,"new":"5"},{"seq":172027,"id":"CVE-2026-41131","ts":1789330922432,"field":"severity","old":"none","new":"medium"}]}