CVE-2026-34972 MEDIUM

CVE-2026-34972: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

Vendor Openfga
Product openfga
Weakness CWE-863 · Incorrect authorization
Published April 6, 2026
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

5.0/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.

Key dates

02Disclosure timeline

April 6, 2026 CVE published
April 7, 2026 Record updated