VDB
Sign up
—

GO-2026-6488

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga

Quick fix

GO-2026-6488 — github.com/openfga/openfga: upgrade to the fixed version with the command below.

go get github.com/openfga/openfga@v1.18.1

Details

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/openfga/openfga

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/openfga/openfga
Introduced in: 0Fixed in: 1.18.1
Fixgo get github.com/openfga/openfga@v1.18.1

References