Authorization Middleware Vulnerability in Cedar for Express.js

CVE-2026-49473

What is CVE-2026-49473?

The Cedar authorization middleware for Express.js has a vulnerability that allows attackers to bypass restrictive access controls. The issue arises from the middleware's reliance on req.originalUrl, which includes the entire query string when evaluating authorization policies. This can lead to a situation where requests intended for more secure actions are matched against less secure actions due to overlapping route patterns in the application. For example, an attacker could exploit this by appending a query string to an endpoint designed for admin users, redirecting the request to a less restrictive action. This vulnerability can be mitigated by upgrading to version 0.3.0 or later, and by validating and sanitizing input paths before they reach the authorization middleware, ensuring a more secure authorization framework.

References