CVE-2026-49473: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-49473 is an authorization bypass vulnerability in @cedar-policy/authorization-for-expressjs, an open-source Express.js middleware that integrates Cedar authorization policies into Express applications. The flaw allows authenticated attackers to bypass more restrictive Cedar authorization policies by appending a query string to a request URL, causing a divergence between what Cedar authorizes and what Express actually routes and executes. All versions up to and including 0.2.0 are affected; version 0.3.0 contains the fix. The vulnerability was first published on May 26, 2026, and added to the GitHub Advisory Database on June 30, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is an interpretation conflict (CWE-436) combined with incorrect authorization (CWE-863): the middleware uses req.originalUrl — which includes the query string — to match incoming requests against Cedar action mappings, while Express itself routes requests using only the path component (req.path). This creates a semantic gap between the authorization layer and the routing layer. For example, when an application defines GET /users (admin-only) and GET /users/{id} (any authenticated user), sending GET /users/?x=1 causes Cedar to match the less restrictive /users/{id} action (treating ?x=1 as the id parameter), while Express routes the request to the privileged /users list handler. The fix, introduced in v0.3.0, replaces req.originalUrl with req.path for action matching (GitHub Advisory, v0.3.0 Release).

Successful exploitation allows an authenticated attacker with low privileges to access endpoints protected by more restrictive Cedar authorization policies, effectively bypassing access controls. In a typical scenario, this could expose sensitive administrative data (e.g., full user listings) to non-admin users, resulting in high confidentiality, integrity, and availability impact as rated by CVSS. The vulnerability is limited in scope to applications that define overlapping path prefixes with differing permission levels, but in such configurations it completely undermines the authorization model enforced by the middleware (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The vulnerability requires low privileges (an authenticated session) and no user interaction, and exploitation is straightforward — simply appending a query string to a targeted URL. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been identified. The vulnerability was detected by Qualys (detection ID 5014854) (GitHub Advisory).

1. Reconnaissance: Identify Express.js applications using @cedar-policy/authorization-for-expressjs version 0.2.0 or earlier, particularly those with overlapping route definitions that have different authorization requirements (e.g., GET /users restricted to admins and GET /users/{id} accessible to any authenticated user).
2. Authenticate: Obtain a valid low-privilege authenticated session or token for the target application.
3. Craft the bypass request: Instead of requesting the restricted endpoint directly (e.g., GET /users), append a query string to the URL: GET /users/?x=1. This causes the Cedar middleware to evaluate req.originalUrl (/users/?x=1) and match it against the less restrictive /users/{id} action pattern.
4. Trigger authorization evaluation: The Cedar middleware evaluates the less restrictive policy (e.g., any authenticated user) and permits the request.
5. Access restricted resource: Express routes the request based on the path only (/users), directing it to the admin-only list handler, granting the attacker access to the privileged endpoint and its data (GitHub Advisory).

• Network: HTTP GET requests to restricted endpoints (e.g., /users/, /admin/) that include unexpected query strings (e.g., GET /users/?x=1, GET /admin/?bypass=1) from non-privileged user accounts.
• Logs: Application access logs showing low-privilege users successfully accessing endpoints that should be restricted to higher-privilege roles; requests where the URL path with query string matches a less restrictive Cedar action pattern.
• Application Behavior: Unexpected data returned to low-privilege users that corresponds to admin-level or aggregate resource listings rather than individual resource responses.

Upgrade @cedar-policy/authorization-for-expressjs to version 0.3.0 or later, which fixes the issue by using req.path instead of req.originalUrl for Cedar action matching (v0.3.0 Release). As a workaround for those unable to upgrade immediately, validate and sanitize incoming request paths before they reach the authorization middleware to strip or reject unexpected query strings on path-sensitive routes. Additionally, avoid relying solely on this middleware for authorization when defining multiple actions on overlapping path prefixes with different permission levels — implement defense-in-depth with additional authorization checks at the handler level (GitHub Advisory).

The advisory was published by AWS (maintainer of the cedar-policy project) and security contact is AWS Security at aws-security@amazon.com. No notable independent researcher commentary, social media discussion, or broader media coverage has been identified for this vulnerability at this time (GitHub Advisory).