OpenFGA is an authorization/permission engine designed for developers. When MySQL is used as the datastore, before version 1.18.0 the tuple, changelog, and authorization_model identifier columns applied a case‑insensitive collation. This caused values that differ only by case—such as user:Alice versus user:alice—to be considered equal, so two distinct authorization checks could produce the same result. The vendor fixed this issue in release 1.18.0.

The vulnerability affects the OpenFGA product (openfga:openfga) in any deployment using MySQL as the data store. All releases prior to v1.18.0 are impacted; version v1.18.0 and later include the fix.

The CVSS score of 2.1 indicates a low severity impact, while the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. A scenario in which an attacker could alter the contents of identifier columns—by gaining write access to the database—would allow them to place or modify values that differ only in case, potentially causing the authorization engine to treat distinct users as equivalent. Because the description does not specify any required attacker privileges, we infer that the ability to influence the database is sufficient for exploitation. The attack would not require code execution beyond manipulating database entries and is most relevant in environments that rely on case‑sensitive user identifiers.