CVE-2026-49473

Name of the Vulnerable Software and Affected Versions @cedar-policy/authorization-for-expressjs versions prior to 0.3.0

Description This middleware integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions. A discrepancy exists because the middleware uses req.originalUrl to match requests against Cedar action mappings, which includes the query string, whereas Express routes requests using only the path component. This divergence allows an actor to bypass restrictive policies when an application defines separate actions for overlapping path prefixes with different authorization requirements. For example, if GET /users requires admin access and GET /users/{id} allows any authenticated user, sending a request to /users/?x=1 may cause the middleware to match the less restrictive /users/{id} action while Express routes the request to the /users handler, granting unauthorized access to the restricted endpoint.

Recommendations Update to version 0.3.0. Validate and sanitize incoming request paths before they reach the authorization middleware. Ensure applications do not rely solely on the middleware for authorization when defining multiple actions on overlapping path prefixes with different permission levels.