Overview
CVE-2025-64751 identifies an improper policy enforcement vulnerability affecting OpenFGA, a high-performance and flexible authorization/permission engine inspired by Google Zanzibar. Specifically, versions v1.4.0 to v1.11.0 of OpenFGA are susceptible to this flaw. This vulnerability can lead to incorrect access control decisions when certain Check and ListObject calls are executed, potentially granting unauthorized access to resources.
The affected components include the Helm chart (versions openfga-0.1.34 to openfga-0.2.48) and Docker images (versions v1.4.0 to v1.11.0). A fix is available in OpenFGA version 1.11.1.
Technical Details
The vulnerability stems from a flaw in the logic used to evaluate authorization policies during Check and ListObject operations. Under specific conditions, the engine may fail to correctly apply the defined authorization rules, leading to incorrect permit or deny decisions. The exact root cause and triggering conditions are detailed in the security advisory provided by OpenFGA.
Understanding the specific configuration and authorization model is crucial to assess the potential impact. Administrators should review their OpenFGA configurations and policies to determine if they are vulnerable to this issue.
CVSS Analysis
Currently, the National Vulnerability Database (NVD) does not provide a CVSS score for CVE-2025-64751. However, the severity is considered to be N/A because an assigned severity score does not exist. The actual severity of this vulnerability depends heavily on the specifics of how OpenFGA is deployed and the sensitivity of the protected resources.
A comprehensive risk assessment should be performed by organizations using affected versions of OpenFGA to determine the potential business impact.
Possible Impact
The potential impact of CVE-2025-64751 could be significant, including:
- Unauthorized Access: Users may gain access to resources that they should not be authorized to view, modify, or delete.
- Data Breaches: Sensitive data could be exposed to unauthorized individuals or systems.
- Privilege Escalation: Attackers might be able to escalate their privileges within the system.
- Compliance Violations: Failure to properly enforce access controls could lead to violations of regulatory compliance requirements.
Mitigation and Patch Steps
The recommended mitigation is to upgrade OpenFGA to version 1.11.1 or later. Follow these steps:
- Backup Your Configuration: Before upgrading, create a backup of your OpenFGA configuration and data.
- Upgrade OpenFGA:
- Using Helm: If you deployed OpenFGA using Helm, update your Helm chart to version
openfga-0.2.49or later. Refer to the OpenFGA documentation for specific upgrade instructions. - Using Docker: If you are using Docker, pull the
v1.11.1or later Docker image and redeploy your OpenFGA container.
- Using Helm: If you deployed OpenFGA using Helm, update your Helm chart to version
- Verification: After upgrading, thoroughly test your authorization policies to ensure they are functioning correctly.
