CVE-2025-46331: Critical Authorization Bypass in OpenFGA

CVE-2025-46331 is a critical authorization bypass (CVSS 9.8 in the NVD record) in OpenFGA 1.8.10 and earlier, back to 1.3.6. It affects certain Check and ListObjects calls when the model has a tuple cycle and the check cache is on. Upgrade to 1.8.11, which the advisory calls backwards compatible.

What's affected

The NVD record says OpenFGA versions up to v1.8.10 are affected, as are Helm chart versions up to openfga-0.2.28 and Docker images up to v1.8.10. The GitHub advisory narrows the range to 1.3.6 up to but not including 1.8.11, and it names 1.8.11 as the patched release.

The advisory also lists conditions. You are affected if you call the Check API or ListObjects with an authorization model that has a tuple cycle, the check query cache is enabled, and several check or list requests involving the cycle arrive within the cache TTL.

Note the score difference. The NVD record scores the flaw 9.8 critical. The GitHub advisory shows a moderate rating of 5.8 using CVSS v4. Use the higher number for planning unless you have confirmed that your model has no tuple cycles.

How to check if you're exposed

Find the OpenFGA version you run, then look at your authorization model.

• Docker: run the command shown below and look for the openfga image tag.
• Binary: run openfga version on the host.
• Helm: run helm list -A and compare the chart version with openfga-0.2.28.
• Kubernetes: run the command shown below and filter for openfga.

Then check whether your authorization model contains a cycle, meaning a relation that can refer back to itself through other relations. Also check whether the check query cache is enabled in your server configuration. If both are true and you run a version below 1.8.11, treat yourself as exposed.

Commands referred to above, in order:

docker ps --format '{{.Image}}'
kubectl get pods -A -o jsonpath='{..image}'

What to do now

1. Identify every OpenFGA deployment, including staging and development stores that share models with production.
2. Upgrade to v1.8.11 or later. The advisory describes the upgrade as backwards compatible.
3. For Helm, move to a chart release that deploys OpenFGA 1.8.11 or later and confirm the image tag after the rollout.
4. Review your authorization models for tuple cycles and note which services depend on them.
5. If you cannot upgrade immediately, check the advisory for any interim guidance, since it names the cache and the cycle as conditions.
6. After the upgrade, spot check a few Check and ListObjects results for users who should be denied.

Why it matters

The record lists CWE-284 (Improper Access Control). An authorization engine decides who may do what in many other systems. If it returns the wrong answer, every application that trusts it inherits the mistake.

The advisory ties the flaw to cached results involving a cycle in the model. In that case a denied user could get an allowed answer. That is a quiet failure, because nothing crashes and logs show normal calls. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.

Reachability analysis helps here. Knowing that a vulnerable version is deployed is one step. Knowing that your model has a cycle and the cache is on tells you whether you are in the affected path.

Try it yourself

The demo shows how to tell whether a flagged version is actually exploitable in your setup, which is the same question the OpenFGA conditions raise.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD record for CVE-2025-46331
• OpenFGA advisory GHSA-w222-m46c-mgh6
• Fix commit listed in the record

Last reviewed: 18 October 2026.