CVE-2025-64751Medium▾ Sunlit

OpenFGA Improper Policy Enforcement

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score28/ 100 · Low

impact 27.5 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 20, 2025

Updated

Sep 10, 2026

CVSS

—

Vendor

openfga

Product

github.com/openfga/openfga

CWE

—

Depth score

28 · Low

EPSS

0.29% · p22

Platforms

—

Source

OSV

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 296 days

Nov 20, 2025Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 12, 2026EPSS first tracked
0.3%

openfga #osv #go

Affected

github.com/openfga/openfga >= 1.4.0, < 1.11.1

Patched in

github.com/openfga/openfga 1.11.1

Full technical detail▾

Overview

OpenFGA v1.4.0 to v1.11.0 (openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed.

Am I Affected?

You are affected by this vulnerability if you meet the following preconditions:

You are using OpenFGA v1.4.0 to v1.11.0
The model has a a relation directly assignable by a type bound pubic access with condition
The same relation is not assignable by a type bound public access without condition
You have a type assigned for the same relation that is a type bound public access without condition

Fix

Upgrade to v1.11.1. This upgrade is backwards compatible.

Workaround

None

Affected packages

github.com/openfga/openfga >= 1.4.0, < 1.11.1

Remediation

Upgrade to a patched release:

github.com/openfga/openfga 1.11.1

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go

← Back to feed