VDB
Sign up
MEDIUM5.3

GHSA-g3pg-frfm-pr2m

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

Quick fix

GHSA-g3pg-frfm-pr2m — github.com/openfga/openfga: upgrade to the fixed version with the command below.

go get github.com/openfga/openfga@v1.18.1

Details

### Description

In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.

### Preconditions

This applies if all of the following are present:

- The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. `rel1: (public_user but not blocked) and rel2` - The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:*). - A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection. - Your application uses ListUsers to enumerate or enforce access

### Fix

Upgrade to OpenFGA v1.18.1 or greater.

### Acknowledgements

OpenFGA would like to thank @5ud0er for the detailed report.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/openfga/openfga
Introduced in: 0Fixed in: 1.18.1
Fixgo get github.com/openfga/openfga@v1.18.1

References