CVE-2026-107372

View on CVE.org
Published Nov 10, 2026 CVSS n/a EPSS < 1% KEV · Not listed
Description
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Improper Access Control in Auth0 AI JS Document Retrieval
Type Values Removed Values Added
First Time appeared Auth0
Auth0 auth0 Ai Js
Vendors & Products Auth0
Auth0 auth0 Ai Js
Type Values Removed Values Added
Title Improper Access Control in Auth0 AI JS Document Retrieval
Type Values Removed Values Added
Description The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
Weaknesses CWE-863
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Okta
Published
Updated
Nov 10, 2026, 9:05 PM
Reserved
Oct 7, 2026, 8:59 PM

View source JSON

No data.

Status
Awaiting Analysis
Published
Nov 10, 2026, 9:17 PM
Modified
Nov 10, 2026, 10:17 PM

View source JSON

No data.

Updated
Nov 13, 2026, 2:15 AM

JSON