CVE-2025-64751

EUVD-2025-198364
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 19%
Affected Products (NVD)
VendorProductVersion
openfgahelm_charts
0.1.34 ≤
𝑥
< 0.2.49
openfgaopenfga
1.4.0 ≤
𝑥
< 1.11.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/openfga/openfga/releases/tag/v1.11.1
https://github.com/openfga/openfga/security/advisories/GHSA-2c64-vmv2-hgfc