CVE-2026-61709: Improper Policy Enforcement and Exclusion Bypass in OpenFGA ListUsers API

Vulnerability ID: CVE-2026-61709
CVSS Score: 5.3
Published: 2026-09-16

An authorization-decision over-inclusion vulnerability exists in the OpenFGA authorization engine. The flaw manifests within the ListUsers API evaluation path when evaluating complex relationship intersections containing exclusions. Under certain configurations involving wildcards, the exclusion is bypassed, leading to incorrect permission lists.

TL;DR

The OpenFGA ListUsers API fails to apply logical exclusions during intersection resolution if the base relation utilizes a type-bound public wildcard, causing excluded users to be returned as authorized.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-863 / CWE-281
• Attack Vector: Network (AV:N)
• CVSS Base Score: 5.3 (Medium)
• EPSS Score: Not Assigned
• Exploit Status: Proof-of-Concept
• CISA KEV Status: Not Listed
• Impact: Confidentiality (High)

Affected Systems

• OpenFGA authorization engine prior to version 1.18.1
• OpenFGA: < 1.18.1 (Fixed in: 1.18.1)

Code Analysis

Commit: 171806c

fix(listusers): fix exclusion under wildcard in intersection

Mitigation Strategies

• Upgrade OpenFGA to version 1.18.1 or higher to patch the ListUsers solver logic.
• Refactor authorization models to avoid nesting public wildcards within exclusion operations that are subsequently intersected.
• Utilize the Check API for single-user authorization enforcement rather than relying on batch arrays from the ListUsers API.

Remediation Steps:

1. Identify all running instances of OpenFGA in the environment and determine their current version.
2. Review custom OpenFGA authorization models for the pattern: (A but not B) and C, where A is assignable to wildcards.
3. Update the OpenFGA container image or Go dependency to version 1.18.1 or later.
4. Deploy the patched version to staging, and execute integration tests using the official validation assertions.
5. Promote the patched version to production and monitor authorization logs for anomalies.

References

• GitHub Security Advisory GHSA-g3pg-frfm-pr2m
• OpenFGA Fix Commit
• OpenFGA Release v1.18.1

Read the full report for CVE-2026-61709 on our website for more details including interactive diagrams and full exploit analysis.