GHSA-g3pg-frfm-pr2m
OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/openfga/openfga | < 1.18.1 | 1.18.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Description
In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.
### Preconditions
This applies if all of the following are present:
- The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. `rel1: (public_user but not blocked) and rel2`
- The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:*).
- A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection.
- Your application uses ListUsers to enumerate or enforce access
### Fix
Upgrade to OpenFGA v1.18.1 or greater.
### Acknowledgements
OpenFGA would like to thank @5ud0er for the detailed report.
References
External links from the advisory. They lead to third-party sites.