{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-107372","assignerOrgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","state":"PUBLISHED","assignerShortName":"Okta","dateReserved":"2026-10-07T20:59:28.991Z","datePublished":"2026-11-10T21:05:47.870Z","dateUpdated":"2026-11-10T21:05:47.870Z"},"containers":{"cna":{"providerMetadata":{"orgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","shortName":"Okta","dateUpdated":"2026-11-10T21:05:47.870Z"},"problemTypes":[{"descriptions":[{"lang":"en","description":"Incorrect Authorization","cweId":"CWE-863"}]}],"affected":[{"vendor":"Auth0","product":"Auth0 AI JS","versions":[{"version":"0","status":"affected","lessThan":"6.0.3","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-js-document-retrieval-cve-2026-107372"}],"x_generator":{"engine":"cvelib 1.8.0"}}}}