Description
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| auth0 | auth0-ai-llamaindex | 0 <1.0.3 | — |
| auth0 | auth0-ai-langchain | 0 <1.0.2 | — |