{"action":"Upgrade github.com/openfga/openfga to 1.18.1 or later.","affected":[{"fixed":"1.18.1","introduced":"0"}],"component":"github.com/openfga/openfga","cve_ids":["CVE-2026-61709"],"ecosystem":"Go","epss":0.00351,"exploited":false,"fixed_versions":["1.18.1"],"ghsa_id":"GHSA-g3pg-frfm-pr2m","id":"tcs_01M5KGV03PEDN17RBE81F4MXHP","modified_at":"2026-09-28T17:00:17.351799519Z","published_at":"2026-09-28T16:43:40Z","references":["https://osv.dev/vulnerability/GO-2026-6488","https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m","https://nvd.nist.gov/vuln/detail/CVE-2026-61709","https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3","https://github.com/openfga/openfga/releases/tag/v1.18.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6488","url":"https://osv.dev/vulnerability/GO-2026-6488"}],"summary":"OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user in github.com/ope"}