{"uuid": "b8c05bbd-95c4-413e-93d6-38674541552e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-g3pg-frfm-pr2m", "type": "seen", "source": "https://gist.github.com/alon710/578422b703a61d9f7998d7bc971d97e1", "content": "# CVE-2026-61709: CVE-2026-61709: Improper Policy Enforcement and Exclusion Bypass in OpenFGA ListUsers API\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61709\n\n## Summary\nAn authorization-decision over-inclusion vulnerability exists in the OpenFGA authorization engine. The flaw manifests within the `ListUsers` API evaluation path when evaluating complex relationship intersections containing exclusions. Under certain configurations involving wildcards, the exclusion is bypassed, leading to incorrect permission lists.\n\n## TL;DR\nThe OpenFGA ListUsers API fails to apply logical exclusions during intersection resolution if the base relation utilizes a type-bound public wildcard, causing excluded users to be returned as authorized.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863 / CWE-281\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 5.3 (Medium)\n- **EPSS Score**: Not Assigned\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Impact**: Confidentiality (High)\n\n## Affected Systems\n\n- OpenFGA authorization engine prior to version 1.18.1\n- **OpenFGA**: < 1.18.1 (Fixed in: `1.18.1`)\n\n## Mitigation\n\n- Upgrade OpenFGA to version 1.18.1 or higher to patch the ListUsers solver logic.\n- Refactor authorization models to avoid nesting public wildcards within exclusion operations that are subsequently intersected.\n- Utilize the Check API for single-user authorization enforcement rather than relying on batch arrays from the ListUsers API.\n\n**Remediation Steps:**\n1. Identify all running instances of OpenFGA in the environment and determine their current version.\n2. Review custom OpenFGA authorization models for the pattern: (A but not B) and C, where A is assignable to wildcards.\n3. Update the OpenFGA container image or Go dependency to version 1.18.1 or later.\n4. Deploy the patched version to staging, and execute integration tests using the official validation assertions.\n5. Promote the patched version to production and monitor authorization logs for anomalies.\n\n## References\n\n- [GitHub Security Advisory GHSA-g3pg-frfm-pr2m](https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m)\n- [OpenFGA Fix Commit](https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3)\n- [OpenFGA Release v1.18.1](https://github.com/openfga/openfga/releases/tag/v1.18.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61709) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T00:00:36.989471Z"}