{"metadata": {"vulnerability": "cve-2025-48371", "count": 19, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 13}}, "data": [{"timestamp": "2025-05-19T15:46:00.395Z", "date_only": false, "value": "2025-05-19T15:46:00.395Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2025-48371", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-05-22T22:20:37.570Z", "date_only": false, "value": "2025-05-22T22:20:37.570Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2025-48371", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-05-22T22:20:37.570Z", "date_only": false, "value": "2025-05-22T22:20:37.570Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2025-48371", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-05-22T22:50:46Z", "date_only": false, "value": "2025-05-22T22:50:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17362", "record": "CVE-2025-48371", "field": "creation_timestamp", "uuid": "1a8fd610-e45e-4a88-b02c-4a6c2bf759cb", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-48371\n\ud83d\udd25 CVSS Score: 5.8 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H)\n\ud83d\udd39 Description: OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples\u2019s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible.\n\ud83d\udccf Published: 2025-05-22T22:20:37.570Z\n\ud83d\udccf Modified: 2025-05-22T22:20:37.570Z\n\ud83d\udd17 References:\n1. https://github.com/openfga/openfga/security/advisories/GHSA-c72g-53hw-82q7\n2. https://github.com/openfga/openfga/commit/e5960d4eba92b723de8ff3a5346a07f50c1379ca", "url": "https://t.me/DarkWebInformer_CVEAlerts/17362"}, {"timestamp": "2025-05-22T23:15:19Z", "date_only": false, "value": "2025-05-22T23:15:19Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C72G-53HW-82Q7", "record": "GHSA-C72G-53HW-82Q7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-05-22T23:15:19.230Z", "date_only": false, "value": "2025-05-22T23:15:19.230", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-48371", "record": "FKIE_CVE-2025-48371", "field": "published"}, {"timestamp": "2025-05-23T14:13:56.997Z", "date_only": false, "value": "2025-05-23T14:13:56.997547Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-48371", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-05-23T14:13:56.997Z", "date_only": false, "value": "2025-05-23T14:13:56.997547Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-48371", "record": "FKIE_CVE-2025-48371", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-05-23T14:14:20.586Z", "date_only": false, "value": "2025-05-23T14:14:20.586Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2025-48371", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-05-23T14:14:20.586Z", "date_only": false, "value": "2025-05-23T14:14:20.586Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2025-48371", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-05-23T18:41:38Z", "date_only": false, "value": "2025-05-23T18:41:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C72G-53HW-82Q7", "record": "GHSA-C72G-53HW-82Q7", "field": "published"}, {"timestamp": "2025-05-30T00:00:00Z", "date_only": false, "value": "2025-05-30T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15179-1", "record": "OPENSUSE-SU-2025:15179-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2025-05-30T00:00:00Z", "date_only": false, "value": "2025-05-30T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15179-1", "record": "OPENSUSE-SU-2025:15179-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2025-05-30T00:00:00Z", "date_only": false, "value": "2025-05-30T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15179-1", "record": "OPENSUSE-SU-2025:15179-1", "field": "document.tracking.generator.date"}, {"timestamp": "2025-05-30T00:00:00Z", "date_only": false, "value": "2025-05-30T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15179-1", "record": "OPENSUSE-SU-2025:15179-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-03-30T13:56:21Z", "date_only": false, "value": "2026-03-30T13:56:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C72G-53HW-82Q7", "record": "GHSA-C72G-53HW-82Q7", "field": "modified"}, {"timestamp": "2026-06-17T09:29:33.787Z", "date_only": false, "value": "2026-06-17T09:29:33.787", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-48371", "record": "FKIE_CVE-2025-48371", "field": "lastModified"}, {"timestamp": "2026-09-20T21:34:36Z", "date_only": false, "value": "2026-09-20T21:34:36Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15179-1", "record": "OPENSUSE-SU-2025:15179-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T21:34:36Z", "date_only": false, "value": "2026-09-20T21:34:36Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2025:15179-1", "record": "OPENSUSE-SU-2025:15179-1", "field": "document.tracking.current_release_date"}]}