OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. In pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in version 1.18.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API
    could return a user that should have been excluded when an authorization relation used an intersection
    containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and
    the excluded user also had a concrete tuple through another intersection operand. In
    pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and
    wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to
    enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in
    version 1.18.1. (CVE-2026-61709)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API     could return a user that should have been excluded when an authorization relation used an intersection     containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and     the excluded user also had a concrete tuple through another intersection operand. In     pkg/server/commands/listusers/list_users_rpc.go, expandIntersection counted the concrete tuple and     wildcard without first rejecting entries in excludedUsersMap. Applications that used ListUsers to     enumerate or enforce access could therefore treat an excluded user as authorized. This issue is fixed in     version 1.18.1. (CVE-2026-61709)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462522	Echo: github.com/openfga/openfga: security update to 1.18.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462522	Echo: github.com/openfga/openfga: security update to 1.18.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
346940	Linux Distros Unpatched Vulnerability : CVE-2026-61709	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-61709

medium

Tenable Plugins

medium

medium

medium