CVE-2026-102596

Name of the Vulnerable Software and Affected Versions Nango versions prior to 0.70.9

Description On accounts with Role-Based Access Control (RBAC) enabled via a plan where has rbac is set to true, certain private flow-read routes fail to properly enforce authorization checks. Specifically, the endpoints 'GET /api/v1/integrations/:providerConfigKey/flows' and 'GET /api/v1/flow/:flowName' apply web authentication but omit the necessary permission check can({ action: 'read', resource: 'flow', scopedBy: envScope }). This allows a user within the same team holding the development full access role to request env=prod and read production integration flow metadata or named flow configurations, bypassing production role boundaries. The issue is limited to the same tenant and does not allow crossing tenant boundaries.

Recommendations Update to version 0.70.9.