Description
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openfga | openfga | >= 1.4.0, < 1.11.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | grafana | 11.5.10-150200.3.80.1 | SUSE-SU-2025:4482-1 |
| SLES 15 SP6 | govulncheck-vulndb | 0.0.20251209T172047-150000.1.127.1 | SUSE-SU-2025:4395-1 |
| SLES 15 SP6 | grafana | 11.5.10-150200.3.80.1 | SUSE-SU-2025:4482-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.1.23-150002.3.6.1 | SUSE-SU-2025:4446-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 11.5.10-150002.4.6.1 | SUSE-SU-2025:4446-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.1.23-150002.3.6.1 | SUSE-SU-2025:4446-1 |
| SUSE Multi Linux Manager Tools SLE-12 | Multi-Linux-ManagerTools-SLE-release | 12-120002.1.11.1 | SUSE-SU-2025:4444-1 |
| SUSE Multi Linux Manager Tools SLE-12 | grafana | 11.5.10-120002.4.6.1 | SUSE-SU-2025:4444-1 |
| SUSE Multi Linux Manager Tools SLE-12 | uyuni-tools | 5.1.23-120002.3.6.1 | SUSE-SU-2025:4444-1 |
| SUSE Manager Server LTS 4.3 | release-notes-susemanager | 4.3.16.2-150400.3.148.1 | SUSE-SU-2025:4479-1 |
| SUSE Manager Proxy LTS 4.3 | release-notes-susemanager-proxy | 4.3.16.2-150400.3.104.2 | SUSE-SU-2025:4479-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251209T172047-150000.1.127.1 | SUSE-SU-2025:4395-1 |
| openSUSE Leap 15.6 | grafana | 11.5.10-150200.3.80.1 | SUSE-SU-2025:4482-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/openfga/openfga | >= 1.4.0, < 1.11.1 | 1.11.1 | GHSA-2c64-vmv2-hgfc |
Advisories 6
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2025:4444-1 Security update 5.1.1.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4482-1 Security update for grafana SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4446-1 Security update 5.1.1.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4395-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4479-1 Security update 4.3.16.2 for Multi-Linux Manager Server LTS SUSE / openSUSE Security Updates · Mar 23, 2026