https://vulnerability.circl.lu/sightings/feed 2026-05-30T02:20:38.752862+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1a8fd610-e45e-4a88-b02c-4a6c2bf759cb/export 2026-05-30T02:20:39.190238+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1a8fd610-e45e-4a88-b02c-4a6c2bf759cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-48371", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17362", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-48371\n\ud83d\udd25 CVSS Score: 5.8 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H)\n\ud83d\udd39 Description: OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples\u2019s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.\n\ud83d\udccf Published: 2025-05-22T22:20:37.570Z\n\ud83d\udccf Modified: 2025-05-22T22:20:37.570Z\n\ud83d\udd17 References:\n1. https://github.com/openfga/openfga/security/advisories/GHSA-c72g-53hw-82q7\n2. https://github.com/openfga/openfga/commit/e5960d4eba92b723de8ff3a5346a07f50c1379ca", "creation_timestamp": "2025-05-22T22:50:46.000000Z"} 2025-05-22T22:50:46+00:00