CVE-2026-108167

Not scored yetLast modified Nov 10, 2026

Description

The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1081686.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-tCVE-2026-108177.5Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP ProfiCVE-2026-1081745.3Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access ControCVE-2026-1081756.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-CVE-2026-1081784.2IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to aCVE-2026-1081797.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows BCVE-2026-108188.1The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunCVE-2026-1081847.4Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure vCVE-2026-1081857.4Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information CVE-2026-1081869.6Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network CVE-2026-1081878.1Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network acCVE-2026-108196.5Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce
CVE-2026-108167: Unscored | Vulnix