CVE-2026-48096 — MEDIUM (5.0)

Q: How severe is CVE-2026-48096?

CVE-2026-48096 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-48096?

Check the references section above for vendor advisories and patch information. Affected products include: Openfga Helm Charts, Openfga Openfga.

Vulnerability Description

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.

CVSS Score

5.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Openfga	Helm Charts	< 0.3.5
Openfga	Openfga	< 1.16.0

Related Weaknesses (CWE)

CWE-345 CWE-668

References

https://github.com/openfga/openfga/releases/tag/v1.16.0ProductRelease Notes
https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4wVendor Advisory

FAQ

What is CVE-2026-48096?

CVE-2026-48096 is a vulnerability with a CVSS score of 5.0 (MEDIUM). OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to Op...

How severe is CVE-2026-48096?

CVE-2026-48096 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-48096?

Check the references section above for vendor advisories and patch information. Affected products include: Openfga Helm Charts, Openfga Openfga.