OpenFGA is an authorization engine that supports MySQL as a datastore. Prior to version 1.18.0, deployments that relied on case‑sensitive user identifiers had identifier columns – tuple, changelog, and authorization_model – using a case‑insensitive collation. This caused values that differ only by case, such as user:Alice and user:alice, to be treated as equivalent, so two distinct authorization checks returned the same result. An attacker could exploit this to gain unintended access by manipulating stored identifiers. The vulnerability is fixed in version 1.18.0.

The vulnerability affects the OpenFGA product (openfga:openfga) in any deployment using MySQL as the data store. All releases prior to v1.18.0 are impacted; version v1.18.0 and later include the fix.

The CVSS score of 2.1 indicates a low severity impact, while the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. A scenario in which an attacker could alter the contents of identifier columns—by gaining write access to the database—would allow them to place or modify values that differ only in case, potentially causing the authorization engine to treat distinct users as equivalent. Because the description does not specify any required attacker privileges, we infer that the ability influence the database is sufficient for exploitation. The attack would not require code execution beyond manipulating database entries and is most relevant in environments that rely on case‑sensitive user identifiers.