CVE-2026-34972

CVE-2026-34972 affects OpenFGA, an authorization engine used for permission management, impacting versions 1.8.0 through 1.13.1. The vulnerability allows improper policy enforcement when BatchCheck operations process multiple authorization checks for the same object, relation, and user combination, potentially bypassing intended access controls. This flaw is corrected in version 1.14.0 and later. The vulnerability carries a HIGH severity rating with a CVSS score of 8.8, reflecting a network-accessible attack vector requiring only low privileges with no user interaction needed. The attack can result in significant compromise across confidentiality, integrity, and availability of the affected system. Exploitation status remains minimal at this time, with no confirmed active exploitation or public exploit code availability. The vulnerability is tracked on the Active Hot List but has not achieved KEV designation, and the EPSS score of 0.00016 indicates exploitation probability remains low relative to the broader CVE landscape, though organizations should prioritize patching to version 1.14.0 or later.