VULNRABLE / Vulnerability / CVE-2026-61709

CVE-2026-61709

MEDIUM LOW github.com/openfga/openfga GHSA

Exploit verdict: No active-exploit signal

CVSS Score

5.5

Severity

MEDIUM

EPSS

—

Source

GHSA

Summary

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another ...

What this means

CVE-2026-61709 is a medium-severity vulnerability affecting github.com/openfga/openfga, rated CVSS 5.5. Published September 17, 2026.

View full advisory at GHSA →