CVE-2022-39342: 
Wolfi vulnerability analysis and mitigation

OpenFGA (an authorization/permission engine) versions prior to 0.2.4 were discovered to be vulnerable to authorization bypass under specific conditions. The vulnerability, identified as CVE-2022-39342, was discovered during an internal security assessment and disclosed on October 24, 2022. The vulnerability affects users whose authorization model has a relation defined as a tupleset (the right hand side of a 'from' statement) that involves anything other than a direct relationship (e.g., 'as self') (GitHub Advisory).

The vulnerability stems from issues in the handling of tupleset relations in the authorization model. Specifically, it affects models where relations are defined as tuplesets that involve complex relationships beyond direct relationships. The issue was classified as High severity and required modifications to the way OpenFGA handles tupleset relations in the authorization model (GitHub Release).

The vulnerability could lead to authorization bypass, potentially allowing unauthorized access to protected resources. This could compromise the security model of applications using affected versions of OpenFGA for permission management (GitHub Advisory).

The vulnerability was patched in OpenFGA version 0.2.4. Users are strongly advised to upgrade to this version or later. It's important to note that this update is not backward compatible, and any model involving rewritten tupleset relations will need to be modified to comply with the new security requirements (GitHub Release, GitHub Advisory).