OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4482-1 advisory.

    grafana was updated from version 11.5.5 to 11.5.10:

    - Security issues fixed:

      * CVE-2025-64751: Dropped experimental implementation of authorization Zanzana server/client (version     11.5.10)         (bsc#1254113)
      * CVE-2025-47911: Fixed parsing HTML documents (version 11.5.10) (bsc#1251454)
      * CVE-2025-58190: Fixed excessive memory consumption (version 11.5.10) (bsc#1251657)
      * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
      * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
      * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
      * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version     11.5.6)                        (bsc#1245302)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4479-1 advisory.

    release-notes-susemanager:

    - Update to SUSE Manager 4.3.16.2
      * SUSE Linux Enterprise Server 15 SP6 LTSS channels enabled
      * CVEs Fixed:
        CVE-2025-11065, CVE-2025-64751, CCVE-2025-47911, CVE-2025-58190         CVE-2025-62349, CVE-2025-62348
      * Bugs mentioned:
        bsc#1237060, bsc#1241455, bsc#1250911, bsc#1251864, bsc#1253024

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenFGA is a high-performance and flexible authorization/permission engine built for developers and
    inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48,
    v.1.4.0 <= docker <= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and
    ListObject calls are executed. This issue has been patched in version 1.11.1. (CVE-2025-64751)

ID	Name	Product	Family	Severity
311761	openSUSE 16 Security Update : grafana (openSUSE-SU-2026:20654-1)	Nessus	SuSE Local Security Checks	high
279356	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:4482-1)	Nessus	SuSE Local Security Checks	medium
279354	SUSE SLES15 : Security update 4.3.16.2 for Multi-Linux Manager Server LTS (SUSE-SU-2025:4479-1)	Nessus	SuSE Local Security Checks	high
436135	SCA: security update for github.com/openfga/openfga (GHSA-2c64-vmv2-hgfc)	Tenable Cloud Security	SCA Checks	medium
436135	SCA: security update for github.com/openfga/openfga (GHSA-2c64-vmv2-hgfc)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-64751

medium

Tenable Plugins

high

medium

high

medium

medium