1. Home
  2. CVE Database
  3. CVE-2026-34972
MEDIUM · 5.0

CVE-2026-34972

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with ...

Vulnerability Description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.

CVSS Score

5.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
OpenfgaHelm Charts>= 0.2.16, < 0.2.62
OpenfgaOpenfga>= 1.8.0, < 1.14.0

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2026-34972?

CVE-2026-34972 is a vulnerability with a CVSS score of 5.0 (MEDIUM). OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with ...

How severe is CVE-2026-34972?

CVE-2026-34972 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-34972?

Check the references section above for vendor advisories and patch information. Affected products include: Openfga Helm Charts, Openfga Openfga.