---
id: CVE-2026-61709
title: OpenFGA is an authorization and permission engine built for developers
summary: >-
  OpenFGA is an authorization and permission engine built for developers. Prior
  to 1.18.1, the ListUsers API could return a user that should have been
  excluded when an authorization relation used an intersection containing a base
  but not e…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-281
  - CWE-863
  - CWE-783
vendor: openfga
product: openfga
affected:
  - openfga < 1.18.1
patched:
  - github.com/openfga/openfga 1.18.1
published: '2026-09-16'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61709'
references:
  - url: >-
      https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3
    label: security-advisories@github.com
  - url: 'https://github.com/openfga/openfga/releases/tag/v1.18.1'
    label: security-advisories@github.com
  - url: 'https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61709'
  - url: 'https://github.com/advisories/GHSA-g3pg-frfm-pr2m'
  - url: 'https://github.com/openfga/openfga'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-61709.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-61709'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535473'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-61709'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68777'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68821'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67605'
  - url: 'https://access.redhat.com/errata/RHSA-2026:71040'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
  - csaf
  - vex
  - red-hat
epss: 0.00351
epssPercentile: 0.26015
aliases:
  - GHSA-g3pg-frfm-pr2m
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T17:52:21.970517Z'
ingestedAt: '2026-09-16T14:57:28.065Z'
---

## Overview

OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61709)

Affected packages:

- `github.com/openfga/openfga <= 1.18.0`

Patched in:

- `github.com/openfga/openfga 1.18.1`

Source: https://github.com/advisories/GHSA-g3pg-frfm-pr2m

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Ceph Storage 6, Red Hat Ceph Storage 9, Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-61709.json)
- **RHSA-2026:68777** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68777)
- **RHSA-2026:68821** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68821)
- **RHSA-2026:67605** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67605)
- **RHSA-2026:71040** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71040)