CVE-2026-61709: 
Grafana vulnerability analysis and mitigation

CVE-2026-61709 is an authorization bypass vulnerability in OpenFGA, an open-source authorization and permission engine, where the ListUsers API incorrectly returns users who should have been excluded from access. The flaw affects all OpenFGA versions up to and including 1.18.0 (Go module, Docker image, and Helm chart ≤ 0.3.9) and was originally reported by researcher @5ud0er, published to the GitHub Advisory Database on July 16, 2026, and disclosed publicly on September 16, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, OpenFGA Advisory).

The root cause is classified as CWE-281 (Improper Preservation of Permissions) and CWE-863 (Incorrect Authorization). In pkg/server/commands/listusers/list_users_rpc.go, the expandIntersection function tallied concrete tuples and type-bound public wildcards (user:*) across intersection operands without first checking whether a given user appeared in the excludedUsersMap. This means a user explicitly excluded via a but not clause (e.g., (org_member but not banned) and active) could still satisfy the intersection count if they held a concrete tuple through another operand, causing ListUsers to return them as authorized. Exploitation requires an authenticated, low-privileged attacker who can query the ListUsers API against a store whose authorization model uses the specific intersection-plus-exclusion-plus-wildcard pattern described above (OpenFGA Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker to enumerate user accounts that should be inaccessible according to the enforced authorization policy, resulting in a high confidentiality impact. Applications that rely on ListUsers results to drive access-control decisions (e.g., populating share dialogs or enforcing row-level security) may incorrectly grant excluded users access to protected resources. There is no integrity or availability impact; the vulnerability is limited to information disclosure and potential unauthorized access to resources gated by the flawed API response (Github Advisory).

No public proof-of-concept exploit code exists and no in-the-wild exploitation has been observed as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by high attack complexity — the attacker must identify a store using the precise authorization model pattern (intersection with but not exclusion over a type-bound wildcard) and possess at least low-level authenticated access to the OpenFGA API (Github Advisory, Feedly).

1. Reconnaissance: Identify an OpenFGA deployment running version ≤ 1.18.0 and obtain low-privileged API credentials (e.g., a valid API token or client credentials).
2. Model inspection: Query the OpenFGA ReadAuthorizationModel API to inspect the store's authorization model and identify relations defined as intersections containing a but not exclusion whose base operand is granted via a type-bound public wildcard (e.g., viewer: (org_member but not banned) and active).
3. Tuple verification: Confirm that the target store has a user:* wildcard tuple for the base relation and that at least one concrete user tuple exists for another intersection operand (e.g., user:eve has active on document:1).
4. Trigger the bug: Call the ListUsers API for the affected object and relation (e.g., ListUsers for document:1 with relation viewer). Due to the missing exclusion check in expandIntersection, the API returns the excluded user (e.g., user:eve) alongside legitimately authorized users.
5. Leverage results: Use the returned user list to identify accounts that should be blocked, then attempt to interact with protected resources as or on behalf of those accounts, or use the information for further targeted attacks (OpenFGA Advisory, Fix Commit).

• Network: Unusual or repeated ListUsers API calls from low-privileged accounts targeting objects with complex intersection-based authorization models; API calls from unexpected source IPs querying multiple stores or objects in rapid succession.
• Logs: OpenFGA access logs showing ListUsers requests for relations that include but not exclusion patterns, particularly where the response includes users known to be in a blocked/banned relation; audit log entries showing a banned or excluded user being returned in ListUsers results.
• Application: Downstream application logs showing access grants to users who should be excluded (e.g., a banned user appearing in a share list or being granted resource access based on ListUsers output).

Upgrade OpenFGA to version 1.18.1 or later (Go module github.com/openfga/openfga, Docker image openfga/openfga:1.18.1, Helm chart 0.3.10). The fix adds an explicit check in expandIntersection to skip any user already present in excludedUsersMap before evaluating intersection satisfaction. No configuration-based workaround is available; the only remediation is upgrading. Additionally, review any application logic that consumes ListUsers results for access-control enforcement and add downstream filtering of excluded users as a defense-in-depth measure until the upgrade is applied (OpenFGA Advisory, v1.18.1 Release).

The vulnerability was responsibly disclosed by researcher @5ud0er, who was credited by the OpenFGA project for the detailed report. The OpenFGA maintainers published the advisory and patch promptly. No significant broader media coverage or notable community commentary beyond the official advisory has been identified.