[GHSA] GHSA-g3pg-frfm-pr2m (medium) — OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

GHSA-g3pg-frfm-pr2m Severity: medium CVE: CVE-2026-61709

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

### Description

In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded.

### Preconditions

This applies if all of the