---
id: "CVE-2026-107372"
page: "https://infrastack.ai/live/CVE-2026-107372"
kind: "vulnerability"
aliases: ["CVE-2026-107372"]
title: "auth0-ai-js FGA retriever leaks documents denied by authorization into AI context"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "@auth0/ai", "fixed": ["6.0.3"], "affected": "<= 6.0.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["ai-tooling", "auth0", "fga", "javascript", "llm", "npm", "rag"]
not_affected_if: ["no-conditional-checks", "no-fga-retriever", "no-rag"]
published_at: "2026-11-10T21:17:52+00:00"
first_seen_at: "2026-11-10T21:46:08+00:00"
updated_at: "2026-11-10T21:51:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107372", "first_seen_at": "2026-11-10T21:46:08+00:00"}, {"source": "analyst", "url": "https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9", "first_seen_at": "2026-11-10T21:51:24+00:00", "cites": ["https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9"]}]
exploit_sources: []
---

# auth0-ai-js FGA retriever leaks documents denied by authorization into AI context

Link for people: https://infrastack.ai/live/CVE-2026-107372 (this .md is for agents)

The auth0-ai-js FGA retriever fails to tell apart authorization checks run under different conditions when filtering documents for retrieval-augmented generation. Documents that Auth0 FGA denies can therefore end up in the model context and in the generated response.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@auth0/ai affected <= 6.0.2 fixed 6.0.3

## How to check

Run npm ls @auth0/ai (or check package-lock.json / pnpm-lock.yaml / yarn.lock): versions <= 6.0.2 are affected. You are exposed only if you also use the FGA retriever (FGARetriever) with Auth0 FGA conditional checks (context-dependent checks), and a single retrieval can return several documents that share the same object, user and relation but differ in authorization context. Also check the framework packages that wrap it (@auth0/ai-langchain, @auth0/ai-llamaindex, @auth0/ai-vercel) if they pin an older @auth0/ai.

## Fix

Upgrade @auth0/ai to 6.0.3 or later.

## Timeline

- 2026-11-10T21:46:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107372
- 2026-11-10T21:51:24+00:00 analyst https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9 — Read GHSA-rcmp-9f79-cfm9 (auth0 maintainers): <=6.0.2 affected, 6.0.3 fixed, CVSS 6.5 moderate. No exploitation/PoC found; no community search done (low-profile). Package naming in advisory inconsistent (auth0-ai-js npm vs @auth0/ai); used @auth0/ai from the Fix line.

## Documents

- [advisory] GHSA-rcmp-9f79-cfm9: Improper Access Control in auth0-ai-js Document Retrieval https://github.com/auth0/auth0-ai-js/security/advisories/GHSA-rcmp-9f79-cfm9

## From the sources

The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_