VULNERABILITY INTELLIGENCE

CVE-2026-48096

CVSS score5 MEDIUM
EPSS probability0.10%
CISA KEVNot currently listed
Published2026-06-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Description

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.

Weakness classification

  • security-advisories@github.com: CWE-345

Primary references