Description In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response. Preconditions This applies if the following preconditions are met: 1. You run OpenFGA with MySQL as the datastore 2. Your authorization decisions rely on case-sensitive user strings. Fix Upgrade to OpenFGA 1.18.0 or greater. Acknowledgements OpenFGA would like to thank @sahajamoth for the detailed report.