CVE-2022-39340 MEDIUM

CVE-2022-39340: OpenFGA Information Disclosure

Vendor Openfga
Product openfga
Weakness CWE-285
Published October 25, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, resulting in disclosure of objects in the store. Users `openfga/openfga` versions 0.2.3 and prior who are exposing the OpenFGA service to the internet are vulnerable. Version 0.2.4 contains a patch for this issue.

Key dates

02Disclosure timeline

October 25, 2022 CVE published
April 23, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-33162 Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions CVE-2026-3670 Freedom Factory dGEN1 com.dgen.alarm improper authorization CVE-2025-3567 veal98 小牛肉 Echo 开源社区系统 Ticket LoginTicketInterceptor.java preHandle improper authorization CVE-2020-9049 victor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability CVE-2025-12360 Better Find and Replace <= 1.7.7 - Missing Authorization