{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-108167","sourceIdentifier":"psirt@okta.com","published":"2026-11-10T21:17:53.883","lastModified":"2026-11-10T22:17:44.923","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"auth0-ai-langchain","defaultStatus":"unaffected","collectionURL":"https://pypi.org","packageName":"auth0-ai-langchain","versions":[{"version":"0","lessThan":"1.0.2","versionType":"python","status":"affected"}]},{"vendor":"Auth0","product":"auth0-ai-llamaindex","defaultStatus":"unaffected","collectionURL":"https://pypi.org","packageName":"auth0-ai-llamaindex","versions":[{"version":"0","lessThan":"1.0.3","versionType":"python","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-python-document-retrieval-cve-2026-108167","source":"psirt@okta.com"}]}}