{"id":"CVE-2026-61709","aliases":["GHSA-g3pg-frfm-pr2m","GO-2026-6488"],"url":"https://o3.security/vulnerability/CVE-2026-61709","summary":"OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user","details":"### Description\n\nIn OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.\n\n\n### Preconditions\n\nThis applies if all of the following are present:\n\n- The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. `rel1: (public_user but not blocked) and rel2`\n- The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:*).\n- A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection.\n- Your application uses ListUsers to enumerate or enforce access\n\n### Fix\n\nUpgrade to OpenFGA v1.18.1 or greater.\n\n### Acknowledgements\n\nOpenFGA would like to thank @5ud0er for the detailed report.","published":"2026-09-16T14:05:35.455Z","modified":"2026-10-28T02:31:11.713504798Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00336,"percentile":0.2695,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/openfga/openfga","fixedVersion":"1.18.1"}],"fix":{"url":"https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3","label":"openfga/openfga@171806c"},"references":[{"type":"WEB","url":"https://github.com/openfga/openfga/releases/tag/v1.18.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61709.json"},{"type":"ADVISORY","url":"https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61709"},{"type":"FIX","url":"https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3"},{"type":"PACKAGE","url":"https://github.com/openfga/openfga"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:11.713504798Z"}}