PkgSeer

Vulnerability GO-2026-6488

Unknown

3 hours ago

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga

v0.0.1 - v1.18.0

Summary

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga

Details

OpenFGA: ListUsers returns a deliberately-excluded user when a but not exclusion under a type-bound wildcard is intersected (and) with another relation that also grants that user in github.com/openfga/openfga

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

v0.0.1 - v1.18.0 GHSA-g3pg-frfm-pr2m

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset in github.com/openfga/openfga

v0.0.1 - v1.17.1 GO-2026-5423

OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision in github.com/openfga/openfga

v1.8.0 - v1.13.1 GO-2026-5483

OpenFGA Improper Policy Enforcement in github.com/openfga/openfga

v0.0.1 - v1.17.1 GO-2026-5322

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga

v0.0.1 - v1.15.1 GO-2026-5239

View all vulnerabilities for these packages

Impacted packages

github.com/openfga/openfga

Timeline

Published

3 hours ago

Last Modified

2 hours ago