CVE-2026-107372

Not scored yetLast modified Nov 10, 2026

Description

The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Auth0Auth0 AI JS< 6.0.3

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1073739.1ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. CVE-2026-1073758.8JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0CVE-2026-1073768.2webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive desceCVE-2026-1073777.5datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schCVE-2026-1073788.7CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containCVE-2026-1073796.5savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make clCVE-2026-107386.4The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in alCVE-2026-1073805.4savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expaCVE-2026-1073816.5svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG CVE-2026-1073825.9MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zCVE-2026-1073837.5MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7,CVE-2026-1073848.1MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4
CVE-2026-107372: Unscored | Vulnix