{"action":"Upgrade github.com/openfga/openfga to 1.13.1 or later.","affected":[{"fixed":"1.13.1","introduced":"0"}],"component":"github.com/openfga/openfga","cve_ids":["CVE-2026-33729"],"ecosystem":"Go","epss":0.00306,"exploited":false,"fixed_versions":["1.13.1"],"ghsa_id":"GHSA-h6c8-cww8-35hf","id":"tcs_01M5KGGJM2P8ZB7ENDBNJ5P94K","modified_at":"2026-03-27T17:14:39.611226Z","published_at":"2026-03-26T20:33:09Z","references":["https://osv.dev/vulnerability/GO-2026-4857","https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf","https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8","https://github.com/openfga/openfga/releases/tag/v1.13.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4857","url":"https://osv.dev/vulnerability/GO-2026-4857"}],"summary":"OpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga"}