Threats affecting pkg:pypi/auth0-ai-llamaindex

CVE-2026-108167 is an authorization vulnerability in the auth0-ai-python FGA retriever component of Auth0's auth0-ai-langchain product. The flaw causes the retriever to fail to properly distinguish authorization checks across different users, relations, or conditions when filtering documents during retrieval-augmented generation. As a result, documents that should be denied by Auth0 FGA policies may be included in the model context and used in generated responses. Fixed versions 1.0.2 and 1.0.3 address this issue.