The vulnerability arises from an improper handling of encrypted pagination tokens in the GetRelationships API of Ory Keto. When a token is decrypted, its content is incorporated directly into a SQL query without sufficient validation. An attacker who can produce a valid token – which is feasible if the default pagination secret is used or if the secret is known – can embed SQL statements that execute against the underlying database. This permits arbitrary SQL execution, allowing read, manipulation, or deletion of authorization data and thereby compromising the confidentiality and integrity of the system.

All installations of Ory Keto released before version 26.2.0 are affected. The risk is greatest when the configuration value `secrets.pagination` is not overridden or when an attacker is able to determine the default public key. If the GetRelationships endpoint is reachable by an external actor, the attacker can supply a forged pagination token to trigger the flaw.

The CVSS score of 7.2 indicates a medium‑to‑high severity vulnerability. EPSS data is not available, but the issue can be triggered through a single HTTP request to a publicly reachable API, making exploitation straightforward. The vulnerability is not listed in the CISA KEV catalog; however, the requirement for only an accessible endpoint and a known or predictable secret means that the attack vector is high probability. The impact includes full read/write access to permission data via arbitrary SQL execution.