CVE-2026-24851 Details
Description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22<= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed. The vulnerability requires a model that has a a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access. This vulnerability is fixed in v1.11.3.
A vulnerability exists in OpenFGA versions 1.8.5 through 1.11.2, including specific Helm chart and Docker versions, allowing improper policy enforcement during certain Check calls. This issue arises in models with relations assignable by both type-bound public and non-public access, and can be exploited under specific conditions related to tuple assignments and object ID lexicography.
Users can upgrade to OpenFGA version 1.11.3, which is backwards compatible. This version is also available in the OpenFGA Helm chart version 0.2.52 and in the OpenFGA Docker image version 1.11.3.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openfga/openfga/releases/tag/v1.11.3 | [email protected] | Release Notes |
| https://github.com/openfga/openfga/security/advisories/GHSA-jq9f-gm9w-rwm9 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openfga helm charts | >= 0.2.22, < 0.2.51 |
CPE
Remediation
| |
| openfga openfga | >= 1.8.5, < 1.11.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 24, 2026 | Initial Analysis | [email protected] |
| Feb 6, 2026 | New CVE Received | [email protected] |