GHSA-cf98-j28v-49v6: OpenFGA Improper Policy Enforcement

lowCVSS 5.4CVE-2026-55170

Description In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response. Preconditions This applies if the following preconditions are met: 1. You run OpenFGA with MySQL as the datastore 2. Your authorization decisions rely on case-sensitive user strings. Fix Upgrade to OpenFGA 1.18.0 or greater. Acknowledgements OpenFGA would like to thank @sahajamoth for the detailed report.

Details

Source: GitHub Security Advisories (INTL · database · site)
Severity: low — CVSS 5.4
Published: 2026-06-18
Last updated: 2026-07-21
Exploitation: Not in CISA KEV at last sync

Original advisory: https://github.com/advisories/GHSA-cf98-j28v-49v6

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-551700.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-55170	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

mediumCVE-2026-55170: OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQ…nvd

GHSA-cf98-j28v-49v6: OpenFGA Improper Policy Enforcement

Details

Exploitation outlook

Referenced CVEs

Same CVEs, other sources

More from GitHub Security Advisories