CVE-2026-55170 Details
Description
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.
A vulnerability exists in OpenFGA versions prior to 1.18.0 when MySQL is used as the datastore and authorization decisions depend on case-sensitive user strings. In this scenario, the tuple, changelog, and authorization_model identifier columns can mistakenly treat case-distinct values, such as 'user:Alice' and 'user:alice', as equivalent. This flaw causes two distinct check requests to yield the same response. The issue has been addressed in OpenFGA version 1.18.0.
Upgrade to OpenFGA version 1.18.0 or later. If using OpenFGA with Helm, upgrade to version 0.3.9.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openfga helm charts | < 0.3.9 |
CPE
Remediation
| |
| openfga openfga | < 1.18.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |