Description

OpenFGA: ListUsers returns a deliberately-excluded user when a but not exclusion under a type-bound wildcard is intersected (and) with another relation that also grants that user

Description

In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.

Preconditions

This applies if all of the following are present:

The authorization model contains a relation defined as an intersection (and) where at least one operand is an exclusion of the form base but not excluded: e.g. rel1: (public_user but not blocked) and rel2

The base side of that exclusion is granted through a type-bound public wildcard (e.g. user:*).

A user excluded by the but not clause is also granted, via a concrete tuple, through another operand of the intersection.

Your application uses ListUsers to enumerate or enforce access

Fix

Upgrade to OpenFGA v1.18.1 or greater.

Acknowledgements

OpenFGA would like to thank @5ud0er for the detailed report.

Mitigation

Aliases

References