github.com/openfga/openfga: OpenFGA: Unauthorized access due to ListUsers API returning deliberately excluded users.

A flaw was found in OpenFGA, an authorization and permission engine. The ListUsers application programming interface API could incorrectly return users who should have been excluded from authorization decisions. This vulnerability arises when complex authorization rules, involving both exclusions...

CVE-2026-61709: Improper Preservation of Permissions

OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound...