GHSA-g3pg-frfm-pr2m

Source

https://github.com/advisories/GHSA-g3pg-frfm-pr2m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-g3pg-frfm-pr2m/GHSA-g3pg-frfm-pr2m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g3pg-frfm-pr2m

Aliases

CVE-2026-61709

Downstream

CGA-h8rf-92h7-c67c

Published

2026-09-16T22:15:09Z

Modified

2026-09-16T22:30:08Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

Details

Description

In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.

Preconditions

This applies if all of the following are present:

The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. rel1: (public_user but not blocked) and rel2
The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:*).
A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection.
Your application uses ListUsers to enumerate or enforce access

Fix

Upgrade to OpenFGA v1.18.1 or greater.

Acknowledgements

OpenFGA would like to thank @5ud0er for the detailed report.

Database specific

{
    "cwe_ids": [
        "CWE-281",
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-16T22:15:09Z",
    "nvd_published_at": "2026-09-16T15:17:39Z",
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/openfga/openfga

Package

Name: github.com/openfga/openfga; View open source insights on deps.dev
Purl: pkg:golang/github.com/openfga/openfga

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.18.1

Database specific

last_known_affected_version_range

"<= 1.18.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-g3pg-frfm-pr2m/GHSA-g3pg-frfm-pr2m.json"