{"id":"CVE-2026-55170","title":"OpenFGA Improper Policy Enforcement","summary":"OpenFGA Improper Policy Enforcement","severity":"low","cwe":["CWE-178"],"vendor":"openfga","product":"github.com/openfga/openfga","affected":["github.com/openfga/openfga < 1.18.0"],"patched":["github.com/openfga/openfga 1.18.0"],"published":"2026-06-18","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-cf98-j28v-49v6","references":[{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-cf98-j28v-49v6"},{"url":"https://github.com/advisories/GHSA-cf98-j28v-49v6"}],"tags":["ghsa","go"],"ingestedAt":"2026-06-19T03:39:00.797Z","ecosystem":"go","epss":0.00339,"epssPercentile":0.27351,"slug":"CVE-2026-55170","body":"## Overview\n\n## Description\n\nIn OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response.\n\n## Preconditions\n\nThis applies if the following preconditions are met:\n\n1. You run OpenFGA with MySQL as the datastore\n2. Your authorization decisions rely on case-sensitive user strings.\n\n## Fix\nUpgrade to OpenFGA 1.18.0 or greater.\n\n## Acknowledgements\nOpenFGA would like to thank @sahajamoth for the detailed report.\n\n## Affected packages\n\n- `github.com/openfga/openfga < 1.18.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/openfga/openfga 1.18.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}