ReportizFlow
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Auth0 |
|
No data.
No data.
References
History
Fri, 13 Nov 2026 03:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Unauthorized Document Exposure via Auth0 AI Retrieval FGA Bypass |
Thu, 12 Nov 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Auth0
Auth0 auth0-ai-langchain Auth0 auth0-ai-llamaindex |
|
| Vendors & Products |
Auth0
Auth0 auth0-ai-langchain Auth0 auth0-ai-llamaindex |
Thu, 12 Nov 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Access Control Enables Unauthorized Document Retrieval |
Wed, 11 Nov 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Access Control Enables Unauthorized Document Retrieval |
Tue, 10 Nov 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. | |
| Weaknesses | CWE-863 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Okta
Published: 2026-11-10T21:07:56.515Z
Updated: 2026-11-10T21:07:56.515Z
Reserved: 2026-10-09T15:53:50.156Z
Link: CVE-2026-108167
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-10T21:17:53.883
Modified: 2026-11-10T22:17:44.923
Link: CVE-2026-108167
Redhat
No data.