Strobes VIStrobes VI
CVE DatabaseThreat ActorsResearchAdvisoryAPI Docs
Visit Strobes.coSign Up for Strobes
CVE DatabaseThreat ActorsResearchAdvisoryAPI Docs
Tools
KB Lookup
Visit Strobes.coSign Up for Strobes
HomeCVEs

Do you like the insights?

Strobes vulnerability intelligence is a key component of their Exposure Management platform that helps organizations understand, prioritize, and address security vulnerabilities more effectively.

© 2026 Strobes Security. All rights reserved.
HomeCVEsCVE-2026-24851

CVE-2026-24851

Published: February 16, 2026
Last updated:21 hours ago (February 16, 2026)
Exploit: NoZero-day: NoPatch: YesTrend: Neutral
TL;DR
Updated February 16, 2026

CVE-2026-24851 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.

Key Points
  • 1Low severity (CVSS 0.0/10)
  • 2No known public exploits
  • 3Vendor patches are available
Severity Scores
CVSS v30.0
CVSS v20.0
Priority Score0.0
EPSS Score0.0
None
Exploitation LikelihoodMinimal
0.00%EPSS

Very low probability of exploitation

Monitor and patch as resources allow
0.00%
EPSS
0.0
CVSS
No
Exploit
Yes
Patch
Low Priority
no major risk factors

EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.

Description

Impact

OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22 <= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed.

Affected Users

Users are affected by this vulnerability if all of the following preconditions are met:

  • OpenFGA v1.8.5 to v1.11.2 is being used
  • The model has a relation directly assignable by a type bound public access and assignable by type bound non-public access
  • A tuple is assigned for the relation that is a type bound public access
  • A tuple is assigned for the same object with the same relation that is not type bound public access
  • A tuple is assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access

Fix

Upgrade to v1.11.3. This upgrade is backwards compatible.

Workaround

None

CVSS v3 Breakdown
Attack Vector:-
Attack Complexity:-
Privileges Required:-
User Interaction:-
Scope:-
Confidentiality:-
Integrity:-
Availability:-
Patch References
Github.comGithub.com
Trend Analysis
Neutral
Advisories
GitHub AdvisoryNVD
Cite This Page
APA Format
Strobes VI. (2026). CVE-2026-24851 - CVE Details and Analysis. Strobes VI. Retrieved February 17, 2026, from https://vi.strobes.co/cve/CVE-2026-24851
Quick copy link + title

Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.