Listen to this Post
CVE-2026-61709 is an authorization-decision over-inclusion vulnerability in the OpenFGA authorization engine, specifically within the ListUsers API evaluation path. The flaw manifests when the API processes complex relationship intersections that contain exclusions, leading to scenarios where a user who should be excluded is incorrectly returned as authorized. This issue affects OpenFGA versions prior to 1.18.1 and is classified under CWE-863 (Incorrect Authorization) and CWE-281 (Improper Preservation of Permissions).
The vulnerability requires a specific authorization model configuration to be exploitable. The preconditions for this flaw are precise and must all be present for the issue to manifest. The model must contain a relation defined as an intersection (using the `and` operator) where at least one of the operands is an exclusion (using the `but not` operator). For example, a relation might be defined as rel1: (public_user but not blocked) and rel2. Furthermore, the base side of that exclusion—in this example, public_user—must be granted through a type-bound public wildcard, such as user:. Finally, a user who is explicitly excluded by the `but not` clause (in this example, a user who is blocked) must also be granted access via a concrete tuple through another operand of the intersection (such as rel2).
The root cause of the vulnerability lies in the logic of the `expandIntersection` function within the ListUsers API’s implementation, specifically in the file pkg/server/commands/listusers/list_users_rpc.go. When evaluating the intersection, this function incorrectly counts the concrete tuple and the wildcard without first rejecting entries that are present in the excludedUsersMap. This means that even though a user is explicitly listed in an exclusion, if they also have a valid grant through another operand of the intersection, the exclusion is bypassed. As a result, the ListUsers API returns a user who should have been excluded, and applications that rely on this API to enumerate or enforce access control could treat an excluded user as authorized. The vulnerability was reported by researcher @5ud0er and was fixed in OpenFGA version 1.18.1.
DailyCVE Form:
Platform: OpenFGA
Version: 1.18.1
Vulnerability: CVE-2026-61709
Severity: Medium
date: Jul 16, 2026
Prediction: Sep 16, 2026
What Undercode Say:
Analytics
Check current OpenFGA version openfga version Identify vulnerable authorization models Look for patterns like: (public_user but not blocked) and rel2
// Vulnerable code location: pkg/server/commands/listusers/list_users_rpc.go // Function: expandIntersection // Issue: concrete tuple and wildcard counted without checking excludedUsersMap
Verify the fix commit git log --oneline | grep 171806c93b86bca29e0212ceb8b6ee9c48eb9ac3
Exploit: (Educational Purposes!)
The exploit requires an attacker to invoke the ListUsers API when the authorization model meets the specific preconditions. The exploit status is Proof-of-Concept, and no public weaponized exploit exists. The attack vector is network-based, requiring knowledge of the authorization model and the ability to trigger ListUsers queries. An application relying solely on ListUsers for access enumeration would incorrectly list an excluded user as having access.
Protection: from this CVE
Upgrade OpenFGA to version 1.18.1 or later to patch the ListUsers solver logic. If an immediate upgrade is not possible, refactor authorization models to avoid nesting public wildcards within exclusion operations that are subsequently intersected. Additionally, utilize the Check API for single-user authorization enforcement rather than relying on batch arrays from the ListUsers API.
Impact:
The vulnerability allows an excluded user to be incorrectly returned by the ListUsers API. Applications that use this API for access enumeration or enforcement could inadvertently grant access to a user who should be excluded, leading to unauthorized data exposure or privilege escalation. The worst-case scenario involves an attacker or misconfigured client gaining unauthorized access to resources by being incorrectly listed as authorized.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
