{"id":"CVE-2026-108167","published":"2026-11-10T21:17:53.883","lastModified":"2026-11-10T22:17:44.923","description":"The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-python-document-retrieval-cve-2026-108167","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}