CVE-2026-61709: OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/listusersrpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenFGAto a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
Which deployments are affected?
OpenFGA versions prior to 1.18.1 are affected when applications use the ListUsers API with an authorization model containing an intersection where one operand is a type-bound public wildcard with a `but not` exclusion, and another operand concretely grants the excluded user.
What does an attacker need to exploit this issue?
The affected user must be excluded through the relevant `but not` relation while also having a concrete tuple that satisfies another operand of the intersection. The application must rely on ListUsers results to enumerate or enforce access.
How can I determine whether my authorization model is exposed?
Review relations used by ListUsers for intersections combining a base-minus-exclusion operand with another relation. Exposure exists when the base is granted through a type-bound public wildcard and a user excluded by that operand can also receive a concrete tuple through the other intersection operand.
What is the remediation?
Upgrade OpenFGA to version 1.18.1, which fixes the ListUsers intersection expansion logic. Until upgrading, avoid using affected ListUsers results as the sole basis for authorization decisions in the described relation pattern.