Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-16T14:05:35 github.com/openfga/openfga: OpenFGA: Unauthorized access due to ListUsers API returning deliberately excluded users. 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-783

OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.

A flaw was found in OpenFGA, an authorization and permission engine. The ListUsers application programming interface (API) could incorrectly return users who should have been excluded from authorization decisions. This vulnerability arises when complex authorization rules, involving both exclusions and type-bound wildcards, are processed. Consequently, applications relying on ListUsers for access control might inadvertently grant unauthorized access to resources or sensitive information.

This flaw is in OpenFGA's ListUsers API, which could return a user who should have been excluded by a but-not clause when an intersection used a type-bound public wildcard. Red Hat does not ship OpenFGA as a standalone product. The code is bundled in Grafana's experimental Zanzana authorization engine and Grafana is embedded in Red Hat Ceph Storage dashboards, Red Hat Advanced Cluster Management, Multicluster Global Hub, and the RHEL grafana package. Zanzana is disabled by default in upstream Grafana. Grafana's own authorization path uses Check and ListObjects, not ListUsers, so the vulnerable API is not the enforcement path in these products. No product-side mitigation is required while Zanzana remains disabled, which is the default. If Zanzana has been turned on, do not use ListUsers results as an access-control decision; use Check for each user and object until Grafana vendors OpenFGA 1.18.1 or later. Red Hat Hardened Images 2026-09-15T00:00:00Z RHSA-2026:67605 grafana13-2-main-13.2.1-0.4.hum1 Red Hat Hardened Images 2026-09-17T00:00:00Z RHSA-2026:68777 grafana12-4-main-12.4.10-0.5.hum1 Red Hat Hardened Images 2026-09-18T00:00:00Z RHSA-2026:68821 grafana12-4-main-12.4.10-0.6.hum1 Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/acm-grafana-rhel9 Red Hat Ceph Storage 6 Out of support scope rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Out of support scope rhceph/grafana-rhel10 Red Hat Enterprise Linux 10 Fix deferred grafana Red Hat Hardened Images Affected grafana13.1 https://www.cve.org/CVERecord?id=CVE-2026-61709 https://nvd.nist.gov/vuln/detail/CVE-2026-61709 https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3 https://github.com/openfga/openfga/releases/tag/v1.18.1 https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m