OpenFGA's BatchCheck performs deduplication of authorization checks inside a single request. Under specific circumstances related to list‑value cache‑key collisions, the deduplication can incorrectly merge checks, causing the engine to return a permissive policy outcome for a context that should be denied. The result is improper enforcement of access control, allowing a user that should not have access to be granted it, thereby compromising confidentiality and integrity of protected resources.

The vulnerability affects OpenFGA Engine versions 1.8.0 through 1.13.1. Production deployments using any of these releases are at risk until the application is upgraded to version 1.14.0 or later, which contains the remediation.

The CVSS score of 5.0 indicates a moderate level of severity, while the EPSS score of less than 1% points to a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely trigger the issue by submitting multiple authorization checks for the same object, relation, and user within a single request, a vector that is inferred from the described cache‑key collision mechanism. If exploited, the attacker could gain unauthorized access to resources or functionality that should be protected.