{"id":"GHSA-g3pg-frfm-pr2m","summary":"OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user","details":"### Description\n\nIn OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.\n\n\n### Preconditions\n\nThis applies if all of the following are present:\n\n- The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. `rel1: (public_user but not blocked) and rel2`\n- The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:*).\n- A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection.\n- Your application uses ListUsers to enumerate or enforce access\n\n### Fix\n\nUpgrade to OpenFGA v1.18.1 or greater.\n\n### Acknowledgements\n\nOpenFGA would like to thank @5ud0er for the detailed report.","aliases":["CVE-2026-61709"],"modified":"2026-09-16T22:30:08.340244635Z","published":"2026-09-16T22:15:09Z","database_specific":{"cwe_ids":["CWE-281","CWE-863"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-16T22:15:09Z","nvd_published_at":"2026-09-16T15:17:39Z"},"references":[{"type":"WEB","url":"https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61709"},{"type":"WEB","url":"https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3"},{"type":"PACKAGE","url":"https://github.com/openfga/openfga"},{"type":"WEB","url":"https://github.com/openfga/openfga/releases/tag/v1.18.1"}],"affected":[{"package":{"name":"github.com/openfga/openfga","ecosystem":"Go","purl":"pkg:golang/github.com/openfga/openfga"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-g3pg-frfm-pr2m/GHSA-g3pg-frfm-pr2m.json","last_known_affected_version_range":"\u003c= 1.18.0"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}