What happened
Two Okta-published advisories (Nov 10, 2026) describe a broken-access-control defect (CWE-863) in the auth0-ai-js and auth0-ai-python FGA retrievers. When multiple documents in a single retrieval share the same object/user/relation but are authorized under different conditions, the retriever collapses the authorization checks and fails to filter out documents that FGA denied, so denied content reaches the model context and is used in the generated output. Both advisories carry CVSS 6.5 (confidentiality impact).
Why it matters
This is a direct RAG/authorization leak: applications that use fine-grained authorization (FGA) to enforce per-user access on retrieved documents can silently expose data the user is not allowed to see — then inject that data into the LLM's context and the generated answer. This is an AI-specific authorization bypass where the 'confidentiality' boundary is the model's context window, not the API response.
Attack vector
When a single retrieval returns multiple documents that map to the same Auth0 FGA object but differ by the user, relation, or condition under which authorization was evaluated, the FGA retriever does not distinguish between those checks and can include a document that should have been denied by FGA. The unauthorized document then enters the model context and is used to generate the response.
Affected systems
@auth0/ai prior to 6.0.2 (fixed in 6.0.3); auth0-ai-langchain prior to 1.0.2 (fixed in 1.0.2); auth0-ai-llamaindex prior to 1.0.3 (fixed in 1.0.3).
Mitigation
Upgrade @auth0/ai to 6.0.3 or greater; auth0-ai-langchain to 1.0.2 or greater; auth0-ai-llamaindex to 1.0.3 or greater (per Okta advisories CVE-2026-107372 / CVE-2026-108167).