Read the docs
TI-2026-44173 Aliases CVE-2026-61709GHSA-g3pg-frfm-pr2m

Incorrect authorization in openfga

Priority LOW 24CWE-281Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix Partial openfga (openfga): 1.18.1github.com/openfga/openfga (Go): 1.18.1Red Hat: 5 advisoriesRed Hat: 1 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openfgaopenfgabefore 1.18.11.18.1Patch availableCNA
—github.com/openfga/openfga (Go)before 1.18.11.18.1Patch availableGHSA-g3pg-frfm-pr2m
  • openfga Vendoropenfga Affected before 1.18.1 Fixed in 1.18.1 Patch available CNA
  • github.com/openfga/openfga (Go) Vendor— Affected before 1.18.1 Fixed in 1.18.1 Patch available GHSA-g3pg-frfm-pr2m

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*——openfga
  • cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions — — ·openfga

Remediation

  • Fix · CNA openfga (openfga) Fixed in 1.18.1
  • Fix · GHSA-g3pg-frfm-pr2m github.com/openfga/openfga (Go) Fixed in 1.18.1 Advisory →

Red Hat 5 advisories

  • RHSA-2026:72498 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.6-0.4.hum1@aarch64, grafana13.1-13.1.6-0.4.hum1@src, grafana13.1-13.1.6-0.4.hum1@x86_64
  • RHSA-2026:71040 Released 2026-09-23 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.6-0.3.hum1@aarch64, grafana13.1-13.1.6-0.3.hum1@src, grafana13.1-13.1.6-0.3.hum1@x86_64
  • RHSA-2026:68821 Released 2026-09-18 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.10-0.6.hum1@aarch64, grafana12.4-12.4.10-0.6.hum1@src, grafana12.4-12.4.10-0.6.hum1@x86_64
Show 2 more Red Hat advisories
  • RHSA-2026:68777 Released 2026-09-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.10-0.5.hum1@aarch64, grafana12.4-12.4.10-0.5.hum1@src, grafana12.4-12.4.10-0.5.hum1@x86_64
  • RHSA-2026:67605 Released 2026-09-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.4.hum1@aarch64, grafana13.2-13.2.1-0.4.hum1@src, grafana13.2-13.2.1-0.4.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Global HubAffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:67605, RHSA-2026:68777, RHSA-2026:68821, RHSA-2026:71040, RHSA-2026:72498

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61709
  2. 2026-10-03 Alias added: GHSA-g3pg-frfm-pr2m

References

Advisory 1

Other 4

  • TI-2023-17995 OpenFGA denial of service die to circular relationship CVSS 3.1HIGH 7.5
  • TI-2024-28441 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-07597 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2024-20816 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18717 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18716 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences