Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M
CVE-2026-61709OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
Medium 5.3
In plain English
A medium-severity incorrect authorization in openfga from openfga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/openfga/openfga | 1.18.1 | GHSA-g3pg-frfm-pr2m |
| Go | github.com/openfga/openfga | 1.18.1 | GO-2026-6488 |
Affected products (as reported)
Weakness: CWE-281, CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m x_refsource_CONFIRM
- https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3 x_refsource_MISC
- https://github.com/openfga/openfga/releases/tag/v1.18.1 x_refsource_MISC