CVE-2022-39340: 
Wolfi vulnerability analysis and mitigation

OpenFGA, an authorization/permission engine, was found to have a security vulnerability in versions prior to 0.2.4. The vulnerability (CVE-2022-39340) was discovered during an internal security assessment and disclosed on October 24, 2022. The issue affected the streamed-list-objects endpoint, which failed to validate authorization headers properly (GitHub Advisory).

The vulnerability was identified in the streamed-list-objects endpoint of OpenFGA, where the service failed to properly validate authorization headers. This security flaw could lead to information disclosure by allowing unauthorized access to objects in the store. The issue was particularly concerning for installations where the OpenFGA service was exposed to the internet (GitHub Advisory).

The vulnerability could result in the disclosure of objects stored in the OpenFGA store to unauthorized users. This information disclosure risk was particularly significant for systems where OpenFGA services were exposed to the internet, potentially allowing attackers to access sensitive authorization data (GitHub Advisory).

The vulnerability was patched in OpenFGA version 0.2.4. Users running affected versions are strongly advised to upgrade to version 0.2.4 or later. The security update is backward compatible, ensuring a smooth upgrade process (GitHub Advisory, GitHub Release).