CVE-2025-25196
📋 TL;DR
OpenFGA versions before 1.8.5 contain an authorization bypass vulnerability that allows unauthorized access when specific Check and ListObject API calls are made under certain model configurations. This affects users with models containing relations assignable to both public access and usersets of the same type, where attackers can bypass intended authorization controls. The vulnerability impacts all deployments using affected OpenFGA versions with vulnerable model configurations.
💻 Affected Systems
- OpenFGA
📦 What is this software?
Helm Charts by Openfga
Openfga by Openfga
⚠️ Risk & Real-World Impact
Worst Case
Complete authorization bypass allowing unauthorized access to protected resources, potentially leading to data breaches, privilege escalation, and full system compromise.
Likely Case
Unauthorized access to specific objects or resources that should be protected by authorization policies, leading to data exposure or unauthorized actions.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and monitoring are in place to detect anomalous authorization patterns.
🎯 Exploit Status
Exploitation requires understanding of OpenFGA's authorization model and specific vulnerable configurations. Attackers need to craft specific Check or ListObject API calls with particular parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.8.5
Vendor Advisory: https://github.com/openfga/openfga/security/advisories/GHSA-g4v5-6f5p-m38j
Restart Required: Yes
Instructions:
1. Upgrade OpenFGA to version 1.8.5 or later. 2. Update Helm chart to openfga-0.2.22 or later. 3. Update Docker images to v1.8.5 or later. 4. Restart OpenFGA services. 5. Verify the upgrade was successful.
🧯 If You Can't Patch
- Review and modify authorization models to avoid configurations where relations are assignable to both public access and usersets of the same type.
- Implement additional authorization checks at the application layer to validate OpenFGA responses before granting access.
🔍 How to Verify
Check if Vulnerable:
Check OpenFGA version: kubectl get deployment openfga -o jsonpath='{.spec.template.spec.containers[0].image}' or docker inspect openfga/openfga:tag. Verify version is <1.8.4. Review authorization models for vulnerable configurations described in advisory.Check Version:
curl -X GET http://openfga-host:8080/version or check container/image version directlyVerify Fix Applied:
Confirm OpenFGA version is 1.8.5 or higher. Test Check and ListObject API calls with previously vulnerable model configurations to ensure proper authorization enforcement.📡 Detection & Monitoring
Log Indicators:
- Unusual patterns of Check/ListObject API calls with specific parameter combinations
- Authorization failures followed by successful access to protected resources
- Multiple failed authorization attempts from single source
Network Indicators:
- Unusual API call patterns to OpenFGA endpoints
- Traffic spikes to authorization endpoints
- Requests with crafted user/object parameters
SIEM Query:
source="openfga" AND (operation="Check" OR operation="ListObjects") AND status="success" AND previous_events="authorization_failure"