Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61709— OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

Quick assessment

Affected
openfga openfga
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenFGA 是一个面向开发者的授权与权限引擎。在 1.18.1 版本之前，当授权关系使用了包含一个基础操作数但未排除操作数的交集时，如果该基础操作数通过类型绑定的公共通配符授予权限，且被排除的用户还通过另一个交集操作数拥有了具体元组，ListUsers API 可能会错误地返回本应被排除的用户。具体而言，在 中， 函数在统计具体元组和通配符时，未先行检查 中需要排除的条目，导致本应排除的用户被计入结果。因此，使用 ListUsers 来枚举或强制访问控制的应用程序可能会将已被排除的用户误判为已获授权。该问题已在

CVSS 5.3 · Medium EPSS 0.34% · P27

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 1

VendorProduct Version RangeStatus
openfga openfga < 1.18.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61709

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
Source: CVE Program / CVE List V5
Vulnerability Description
OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
权限预留不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
openfga openfga < 1.18.1 -

II. Public POCs for CVE-2026-61709

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61709

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61709 (1)

Vendor Advisories for CVE-2026-61709 (1)

Vendor Pages for CVE-2026-61709 (1)

IV. Related Vulnerabilities

Same product: openfga
Same vendor: openfga
Same weakness: CWE-281

V. Comments for CVE-2026-61709

No comments yet

Leave a comment