Is CVE-2026-61709 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61709 being exploited in the wild.

How severe is CVE-2026-61709?

Medium severity, with a CVSS score of 5.3, published 16 September 2026.

Which products and versions are affected?

github.com/openfga/openfga (Go) <= 1.18.0, SEMVER:introduced=0,fixed=1.18.1; OpenFGA <= 1.18.0.

Is there a fix for CVE-2026-61709?

Yes. github.com/openfga/openfga (Go): upgrade to 1.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61709 attacked?

It is attacked over the network.

Am I affected by CVE-2026-61709?

Check whether you run github.com/openfga/openfga (Go) or OpenFGA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61709: OpenFGA ListUsers incorrect authorization in intersection exclusions

Q: Is there a fix for CVE-2026-61709?

Yes. github.com/openfga/openfga (Go): upgrade to 1.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61709 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-61709?

Check whether you run github.com/openfga/openfga (Go) or OpenFGA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61709 · Severity: medium · CVSS 5.3 · Published 2026-09-16

OpenFGA is an authorization-as-a-service platform used to enforce access control policies. A logic flaw in the ListUsers API can cause it to return users who should have been explicitly excluded from access when certain complex permission rules (involving wildcards and exclusions) are combined. Applications relying on ListUsers to enumerate or enforce permissions could grant access to unintended users.

Technologies: github.com/openfga/openfga (Go), OpenFGA. Vendors: Go, OpenFGA.

Quick answers

Is CVE-2026-61709 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61709 being exploited in the wild.
How severe is CVE-2026-61709?: Medium severity, with a CVSS score of 5.3, published 16 September 2026.
Which products and versions are affected?: github.com/openfga/openfga (Go) <= 1.18.0, SEMVER:introduced=0,fixed=1.18.1; OpenFGA <= 1.18.0.
Is there a fix for CVE-2026-61709?: Yes. github.com/openfga/openfga (Go): upgrade to 1.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61709 attacked?: It is attacked over the network.
Am I affected by CVE-2026-61709?: Check whether you run github.com/openfga/openfga (Go) or OpenFGA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/openfga/openfga (Go): upgrade to 1.18.1 or later
```
go get github.com/openfga/openfga@v1.18.1
```

Technical details

The vulnerability is a logic error in OpenFGA's ListUsers API authorization check (CWE-863: Incorrect Authorization, CWE-281: Improper Preservation of Permissions). The bug manifests when an authorization model uses an intersection (`and`) of multiple relations where at least one operand is an exclusion clause (`base but not excluded`) operating under a type-bound wildcard grant (e.g., `user:*`). If a user is excluded by the `but not` clause but simultaneously granted through a different operand of the intersection via a concrete tuple, the ListUsers API incorrectly includes that user in results. The attack vector is network-based, requires low privileges and a specific authorization model configuration, and has no user interaction requirement. An authenticated attacker with query access to ListUsers could enumerate which users have access, potentially discovering and targeting excluded accounts. The fix is available in OpenFGA v1.18.1 and later.

Affected products

OpenFGA OpenFGA <= 1.18.0

Identifiers

CVE-2026-61709
GHSA-g3pg-frfm-pr2m
GO-2026-6488

Timeline

2026-07-16: disclosed: Published in GitHub Advisory Database
2026-07-16: patched: Fix released in OpenFGA v1.18.1
2026-09-16: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.