OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-61709 · Microsoft / collected KEV context

EUVD-2026-80777

GHSA-g3pg-frfm-pr2m

GO-2026-6488

cve-program · CVE-2026-61709

• https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m
• https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3
• https://github.com/openfga/openfga/releases/tag/v1.18.1

euvd · EUVD-2026-80777

• https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m
• https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3
• https://github.com/openfga/openfga/releases/tag/v1.18.1

nvd · CVE-2026-61709

• https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3
• https://github.com/openfga/openfga/releases/tag/v1.18.1
• https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m

osv · GHSA-g3pg-frfm-pr2m

• https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m
• https://nvd.nist.gov/vuln/detail/CVE-2026-61709
• https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3
• https://github.com/openfga/openfga
• https://github.com/openfga/openfga/releases/tag/v1.18.1

osv · GO-2026-6488

• https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m
• https://nvd.nist.gov/vuln/detail/CVE-2026-61709
• https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3
• https://github.com/openfga/openfga/releases/tag/v1.18.1

No related operational record is retained in the current change model.