Is CVE-2025-25196 actively exploited?

CVE-2025-25196 has no public evidence of in-the-wild exploitation as of 2025-12-31.

What is the CVSS score for CVE-2025-25196?

CVE-2025-25196 has a CVSS score of 5.8 (MEDIUM severity). Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

How do I patch CVE-2025-25196?

Patch guidance is available from openfga security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2025-25196.

Which products are affected by CVE-2025-25196?

2 products: openfga helm charts, openfga openfga.

CVE-2025-25196 - remediation guidance & executive summary

Description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart < openfga-0.2.22, docker < v.1.8.4) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users on OpenFGA v1.8.4 or previous, specifically under the following conditions are affected by this authorization bypass vulnerability: 1. Calling Check API or ListObjects with a model that has a relation directly assignable to both public access AND userset with the same type. 2. A type bound public access tuple is assigned to an object. 3. userset tuple is not assigned to the same object. and 4. Check request's user field is a userset that has the same type as the type bound public access tuple's user type. Users are advised to upgrade to v1.8.5 which is backwards compatible. There are no known workarounds for this vulnerability.

CVSS Metrics

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector: network
Complexity: low
Privileges: low
User Action: none
Confidentiality: undefined
Integrity: undefined
Availability: undefined
Weaknesses: CWE-285

Metadata

Primary Vendor: OPENFGA
Published: 2/19/2025
Last Modified: 12/31/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

openfga : helm_chartsopenfga : openfga

Remediation Guidance

Executive Summary

Cite this page

CVE-2025-25196. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2025-25196

View on NIST NVD

CVE-2025-25196 vulnerability