Executive brief
OpenFGA is an authorization-as-a-service platform used to enforce access control policies. A logic flaw in the ListUsers API can cause it to return users who should have been explicitly excluded from access when certain complex permission rules (involving wildcards and exclusions) are combined. Applications relying on ListUsers to enumerate or enforce permissions could grant access to unintended users.
Technical details
The vulnerability is a logic error in OpenFGA's ListUsers API authorization check (CWE-863: Incorrect Authorization, CWE-281: Improper Preservation of Permissions). The bug manifests when an authorization model uses an intersection (`and`) of multiple relations where at least one operand is an exclusion clause (`base but not excluded`) operating under a type-bound wildcard grant (e.g., `user:*`). If a user is excluded by the `but not` clause but simultaneously granted through a different operand of the intersection via a concrete tuple, the ListUsers API incorrectly includes that user in results. The attack vector is network-based, requires low privileges and a specific authorization model configuration, and has no user interaction requirement. An authenticated attacker with query access to ListUsers could enumerate which users have access, potentially discovering and targeting excluded accounts. The fix is available in OpenFGA v1.18.1 and later.
Affected products
- OpenFGA OpenFGA <= 1.18.0
Timeline
- 2026-07-16: disclosed: Published in GitHub Advisory Database
- 2026-07-16: patched: Fix released in OpenFGA v1.18.1
- 2026-09-16: advisory: NVD record published