{"id":"CVE-2026-61709","aliases":["EUVD-2026-80777","GHSA-g3pg-frfm-pr2m","GO-2026-6488","RHSA-2026:67605","RHSA-2026:68777","RHSA-2026:68821","RHSA-2026:71040","RHSA-2026:72498"],"status":"published","title":"OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user","description":"OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00351,"percentile":0.29011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-281","CWE-863"],"published":"2026-09-16T14:05:35Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"Go","package":"github.com/openfga/openfga","fixed_in":["1.18.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/openfga/openfga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.18.0"},{"fixed":"1.18.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openfga/openfga","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openfga/openfga","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.5.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.6.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.6-0.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.6-0.4.hum1"}]}],"bundled":4}],"products":[{"vendor":"openfga","product":"openfga"}],"references":[{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m","tags":["x_refsource_CONFIRM","advisory","web","article"]},{"url":"https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3","tags":["x_refsource_MISC","fix","web","article"]},{"url":"https://github.com/openfga/openfga/releases/tag/v1.18.1","tags":["x_refsource_MISC","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61709","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g3pg-frfm-pr2m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61709.json","tags":["advisory"]},{"url":"https://github.com/openfga/openfga","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-90771","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9029","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10601","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-61709","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67605.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9029","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-9029","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491359","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10601","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10601","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-10601","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61709","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532688","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90771","tags":["advisory"]},{"url":"https://github.com/hapijs/joi","tags":["article"]},{"url":"https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","tags":["article"]},{"url":"https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","tags":["article"]},{"url":"https://github.com/hapijs/joi/issues/3150","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68777","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81871","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68777.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81871","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68821","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33380","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33378","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28374","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33377","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33376","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28380","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33381","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28376","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28379","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81872","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92599","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68821.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477253","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28374","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28374","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477259","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28376","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28376","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477264","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28379","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28379","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28380","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28380","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28383","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-28383","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477262","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33376","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33376","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477246","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33377","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33377","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33378","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33378","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477248","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33380","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33380","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477239","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33381","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33381","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81872","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81872","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/issues/6797","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/8620","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","tags":["article"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538354","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92599","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92599","tags":["advisory"]},{"url":"https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71040","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86472","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71040.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72498","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93450","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102422","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63209","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72498.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543236","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","tags":["advisory"]},{"url":"https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","tags":["article"]},{"url":"https://github.com/klauspost/compress/releases/tag/v1.18.7","tags":["article"]},{"url":"https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93450","tags":["advisory"]},{"url":"https://github.com/go-openapi/swag","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214","tags":["article"]},{"url":"https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e","tags":["article"]},{"url":"https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102422","tags":["advisory"]},{"url":"https://github.com/ljharb/shell-quote","tags":["article"]},{"url":"https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc","tags":["article"]},{"url":"https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv","tags":["article"]},{"url":"https://www.npmjs.com/package/shell-quote","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-61709","title":"OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user","description":"OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.","status":"published","published":"2026-09-16T14:05:35.455Z","modified":"2026-09-18T17:52:34.349Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-281","CWE-863"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-80777","description":"OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.","status":"published","published":"2026-09-16T14:05:35Z","modified":"2026-09-18T17:52:34Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:07.943492Z"}],"ghsa":[{"id":"GHSA-g3pg-frfm-pr2m","title":"OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user","description":"### Description\n\nIn OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.\n\n\n### Preconditions\n\nThis applies if all of the following are present:\n\n- The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. `rel1: (public_user but not blocked) and rel2`\n- The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:*).\n- A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection.\n- Your application uses ListUsers to enumerate or enforce access\n\n### Fix\n\nUpgrade to OpenFGA v1.18.1 or greater.\n\n### Acknowledgements\n\nOpenFGA would like to thank @5ud0er for the detailed report.","status":"published","published":"2026-09-16T22:15:09Z","modified":"2026-09-16T22:15:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-281","CWE-863"],"updated_at":"2026-11-02T14:41:17.136201Z"}],"nvd":[{"id":"CVE-2026-61709","description":"OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.","status":"published","published":"2026-09-16T15:17:39.66Z","modified":"2026-09-24T21:25:27.05Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-281","CWE-863"],"updated_at":"2026-11-02T14:12:48.630594Z"}],"osv":[{"id":"CVE-2026-61709","title":"OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user","description":"OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.","status":"published","published":"2026-09-16T14:05:35.455Z","modified":"2026-10-28T02:31:11.713504798Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-281","CWE-863"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"GHSA-g3pg-frfm-pr2m","title":"OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user","description":"### Description\n\nIn OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.\n\n\n### Preconditions\n\nThis applies if all of the following are present:\n\n- The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. `rel1: (public_user but not blocked) and rel2`\n- The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:*).\n- A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection.\n- Your application uses ListUsers to enumerate or enforce access\n\n### Fix\n\nUpgrade to OpenFGA v1.18.1 or greater.\n\n### Acknowledgements\n\nOpenFGA would like to thank @5ud0er for the detailed report.","status":"published","published":"2026-09-16T22:15:09Z","modified":"2026-09-28T17:11:12.964165497Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-281","CWE-863"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"RHSA-2026:67605","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:18:47Z","modified":"2026-10-20T10:14:02Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68777","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:30Z","modified":"2026-10-20T10:14:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68821","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:32Z","modified":"2026-10-20T10:14:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:71040","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-24T10:15:13Z","modified":"2026-10-20T10:14:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72498","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-29T10:18:28Z","modified":"2026-10-20T10:43:36.491146369Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"GO-2026-6488","title":"OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga","description":"OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga","status":"published","published":"2026-09-28T16:43:40Z","modified":"2026-09-28T17:00:17.351799519Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}