CVE-2026-61709Medium· 5.3▾ SunlitOpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not e…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/openfga/openfga <= 1.18.0Patched in:
github.com/openfga/openfga 1.18.1Source: https://github.com/advisories/GHSA-g3pg-frfm-pr2m
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39828Medium· 6.3Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
CVE-2026-88016High· 7.1rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-39832Critical· 9.1When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request
CVE-2024-56323MediumOpenFGA Authorization Bypass
CVE-2025-64751MediumOpenFGA Improper Policy Enforcement
CVE-2023-43645Medium· 5.9OpenFGA Vulnerable to DoS from circular relationship definitions