{"id":"CVE-2026-107372","kind":"vulnerability","aliases":["CVE-2026-107372"],"related":[],"title":"auth0-ai-js FGA retriever leaks documents denied by authorization into AI context","description":"The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.","summary":"The auth0-ai-js FGA retriever fails to tell apart authorization checks run under different conditions when filtering documents for retrieval-augmented generation. Documents that Auth0 FGA denies can therefore end up in the model context and in the generated response.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@auth0/ai","fixed":["6.0.3"],"affected":"<= 6.0.2","ecosystem":"npm"}],"ecosystems":[],"tags":["ai-tooling","auth0","fga","javascript","llm","npm","rag"],"not_affected_if":["no-conditional-checks","no-fga-retriever","no-rag"],"how_to_check":"Run npm ls @auth0/ai (or check package-lock.json / pnpm-lock.yaml / yarn.lock): versions <= 6.0.2 are affected. You are exposed only if you also use the FGA retriever (FGARetriever) with Auth0 FGA conditional checks (context-dependent checks), and a single retrieval can return several documents that share the same object, user and relation but differ in authorization context. Also check the framework packages that wrap it (@auth0/ai-langchain, @auth0/ai-llamaindex, @auth0/ai-vercel) if they pin an older @auth0/ai.","fix":"Upgrade @auth0/ai to 6.0.3 or later.","status":"open","published_at":"2026-11-10T21:17:52+00:00","first_seen_at":"2026-11-10T21:46:08+00:00","triaged_at":"2026-11-10T21:50:04+00:00","updated_at":"2026-11-10T21:51:24+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-10T21:50:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"auth0-ai-js FGA retriever leaks documents denied by authorization into AI context","impact":"medium","summary":"The auth0-ai-js FGA retriever fails to tell apart authorization checks run under different conditions when filtering documents for retrieval-augmented generation. Documents that Auth0 FGA denies can therefore end up in the model context and in the generated response.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["auth0","fga","rag","llm","javascript"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Users see documents they are not authorized to access in AI answers","analyst_note":"Find affected version ranges and fixed version for auth0-ai-js on the NVD entry or the vendor advisory; the signal lists no products.","how_to_check":"- Check whether the project depends on the `@auth0/ai` or `auth0-ai-js` packages and note the installed version.\n- Look for use of the FGA retriever in the RAG pipeline code.\n- The sources do not list affected version ranges, so check the advisory or NVD entry for them.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-fga-retriever","no-rag"],"who_is_affected":"Applications that use the auth0-ai-js FGA retriever to filter documents for retrieval-augmented generation and rely on Auth0 FGA to enforce document access. Teams that do not use this retriever, or that do not use Auth0 FGA for retrieval filtering, are likely not affected. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4523,"output_tokens":602,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected version ranges and fixed version for auth0-ai-js on the NVD entry or the vendor advisory; the signal lists no products.","search":"'-107372':17A,20A '-2026':16A,19A 'ai':3A,13A,23B,34B,77C 'ai-tool':22B 'apart':41B 'augment':54B,96C 'auth0':2A,25B,33B,58B,76C,103C 'auth0-ai-js':1A,32B,75C 'auth0/ai':21A 'author':11A,42B,85C 'check':43B,86C 'condit':47B,89C 'context':14A,68B,110C 'cve':15A,18A 'deni':9A,60B,101C 'differ':46B,88C 'distinguish':83C 'document':8A,50B,56B,92C,100C 'end':63B 'fail':38B 'fga':5A,26B,36B,59B,79C,104C 'filter':49B,91C 'generat':55B,72B,97C,115C 'includ':106C 'javascript':27B 'js':4A,35B,78C 'leak':7A 'llm':28B 'model':67B,109C 'npm':29B 'rag':30B 'respons':73B,116C 'result':98C 'retriev':6A,37B,53B,80C,95C 'retrieval-aug':52B,94C 'run':44B 'tell':40B 'therefor':62B 'tool':24B 'use':112C","nicknames":[],"mitigations":[],"who_affected":"Apps using the auth0-ai-js (@auth0/ai) FGA retriever for RAG with Auth0 FGA conditional checks, where one retrieval returns several documents that share the same object, user and relation but differ by authorization context. Then documents FGA denied can reach the model context and the response. Teams not using the FGA retriever, or using only unconditional FGA checks, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:51:24Z","by":"analyst","doc":"https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9","run_id":2868},"products":{"at":"2026-11-10T21:51:24Z","by":"analyst","doc":"https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9","run_id":2868},"how_to_check":{"at":"2026-11-10T21:51:24Z","by":"analyst","doc":"https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9","run_id":2868},"who_affected":{"at":"2026-11-10T21:51:24Z","by":"analyst","doc":"https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9","run_id":2868}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["ai"],"ptokens":["ai","auth0"],"labels":["aitooling","auth0","fga","javascript","llm","medium","npm","rag"],"campaign_type":null,"search_a":"'-107372':17A,20A '-2026':16A,19A 'ai':3A,13A 'auth0':2A 'auth0-ai-js':1A 'auth0/ai':21A 'author':11A 'context':14A 'cve':15A,18A 'deni':9A 'document':8A 'fga':5A 'js':4A 'leak':7A 'retriev':6A","search_b":"'ai':23B,34B 'ai-tool':22B 'apart':41B 'augment':54B 'auth0':25B,33B,58B 'auth0-ai-js':32B 'author':42B 'check':43B 'condit':47B 'context':68B 'deni':60B 'differ':46B 'document':50B,56B 'end':63B 'fail':38B 'fga':26B,36B,59B 'filter':49B 'generat':55B,72B 'javascript':27B 'js':35B 'llm':28B 'model':67B 'npm':29B 'rag':30B 'respons':73B 'retriev':37B,53B 'retrieval-aug':52B 'run':44B 'tell':40B 'therefor':62B 'tool':24B","search_c":"'ai':77C 'augment':96C 'auth0':76C,103C 'auth0-ai-js':75C 'author':85C 'check':86C 'condit':89C 'context':110C 'deni':101C 'differ':88C 'distinguish':83C 'document':92C,100C 'fga':79C,104C 'filter':91C 'generat':97C,115C 'includ':106C 'js':78C 'model':109C 'respons':116C 'result':98C 'retriev':80C,95C 'retrieval-aug':94C 'use':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:17:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107372","severity":null,"published_at":"2026-11-10T21:17:52+00:00","modified_at":"2026-11-10T21:17:52+00:00","first_seen_at":"2026-11-10T21:46:08+00:00","fetched_at":"2026-11-10T21:46:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107372:2868","url":"https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9","severity":null,"published_at":"2026-11-10T21:51:24+00:00","modified_at":"2026-11-10T21:51:24+00:00","first_seen_at":"2026-11-10T21:51:24+00:00","fetched_at":"2026-11-10T21:51:24+00:00","note":"Read GHSA-rcmp-9f79-cfm9 (auth0 maintainers): <=6.0.2 affected, 6.0.3 fixed, CVSS 6.5 moderate. No exploitation/PoC found; no community search done (low-profile). Package naming in advisory inconsistent (auth0-ai-js npm vs @auth0/ai); used @auth0/ai from the Fix line.","cites":["https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9"]}],"documents":[{"id":119299,"url":"https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9","title":"GHSA-rcmp-9f79-cfm9: Improper Access Control in auth0-ai-js Document Retrieval","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}