{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-108167","assignerOrgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","state":"PUBLISHED","assignerShortName":"Okta","dateReserved":"2026-10-09T15:53:50.156Z","datePublished":"2026-11-10T21:07:56.515Z","dateUpdated":"2026-11-10T21:07:56.515Z"},"containers":{"cna":{"providerMetadata":{"orgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","shortName":"Okta","dateUpdated":"2026-11-10T21:07:56.515Z"},"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-863: Incorrect Authorization","cweId":"CWE-863","type":"CWE"}]}],"affected":[{"vendor":"Auth0","product":"auth0-ai-langchain","packageName":"auth0-ai-langchain","collectionURL":"https://pypi.org","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.2","versionType":"python"}]},{"vendor":"Auth0","product":"auth0-ai-llamaindex","packageName":"auth0-ai-llamaindex","collectionURL":"https://pypi.org","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.3","versionType":"python"}]}],"descriptions":[{"lang":"en","value":"The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-python-document-retrieval-cve-2026-108167","tags":["vendor-advisory"]}],"x_generator":{"engine":"cvelib 1.8.0"}}}}