CVE search · CVE-2026-107372
CVE-2026-107372
not scored
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
Details
- Status
- Awaiting Analysis
- Published
- Last changed
- Source
- psirt@okta.com
- Weakness
- CWE-863
Severity
No CVSS score yet. The NVD may still be analysing this CVE.