OpenFGA ListUsers API Exclusion Logic Flaw Fixed in v1.18.1

According to the GitHub Security Advisory database, OpenFGA has addressed a medium-severity issue in its ListUsers API with the release of version 1.18.1. The flaw involved scenarios where a user deliberately excluded via a "but not" clause in a type-bound wildcard could still be returned if the exclusion intersected with another relation that explicitly granted the user access. This issue could affect applications relying on ListUsers for access enumeration or enforcement.

Operators should review their authorization models to identify any use of intersections involving exclusions with type-bound wildcards, such as `rel1: (public_user but not blocked) and rel2`. If such configurations are in place, there is a risk that excluded users may have been incorrectly included in API responses. Testing these scenarios before upgrading is crucial to ensure the fix in v1.18.1 resolves the issue without introducing unexpected behavior in access control logic. This pattern highlights the importance of validating complex authorization rules when upgrading systems that handle nuanced access models.