CVE-2026-49473: 
JavaScript vulnerability analysis and mitigation

CVE-2026-49473 is an authorization bypass vulnerability in @cedar-policy/authorization-for-expressjs, an open-source Express.js middleware that integrates Cedar authorization policies into Express applications. The flaw allows authenticated attackers to bypass more restrictive Cedar authorization policies by appending a query string to a request URL, causing the middleware to evaluate a less restrictive action while Express routes the request to the more privileged endpoint. All versions up to and including 0.2.0 are affected; version 0.3.0 contains the fix. The vulnerability was first published on May 26, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is an interpretation conflict (CWE-436) combined with incorrect authorization (CWE-863): the Cedar middleware evaluates authorization using req.originalUrl, which includes the query string, while Express.js performs route matching using only the path component (req.path). This divergence means the middleware and the router disagree on which route — and therefore which Cedar action policy — applies to a given request. For example, when an application defines GET /users (admin-only) and GET /users/{id} (any authenticated user), sending GET /users/?x=1 causes the middleware to match the less restrictive /users/{id} action (treating ?x=1 as the id parameter), while Express routes the request to the privileged /users list handler. The fix in v0.3.0 changes the middleware to use req.path instead of req.originalUrl for action matching (GitHub Advisory, v0.3.0 Release).

Successful exploitation allows an authenticated but low-privileged user to access endpoints protected by more restrictive Cedar authorization policies, resulting in high confidentiality, integrity, and availability impact as scored by CVSS. In practical terms, an attacker could enumerate or exfiltrate data from admin-only list endpoints (e.g., all user records), modify data through privileged write endpoints, or trigger actions they are not authorized to perform. The impact is limited to applications that define overlapping path prefixes with differing permission levels and rely solely on this middleware for authorization (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, as it requires knowledge of the target application's route structure and overlapping path prefix configurations. The EPSS score is approximately 0.276% (20th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation does require a valid (low-privileged) authenticated session (GitHub Advisory).

1. Reconnaissance: Identify an Express.js application using @cedar-policy/authorization-for-expressjs version ≤ 0.2.0. Review API documentation, JavaScript source, or observed HTTP responses to map out routes with overlapping path prefixes and differing authorization levels (e.g., GET /users requiring admin, GET /users/{id} requiring only authentication).
2. Authenticate: Obtain a valid low-privileged user session or token sufficient to pass basic authentication checks.
3. Craft the bypass request: Append a query string to the more restrictive endpoint's path. For example, instead of GET /users, send GET /users/?x=1. The trailing slash followed by a query parameter causes the Cedar middleware to match the /users/{id} pattern (treating ?x=1 as the id value) and evaluate the less restrictive policy.
4. Trigger authorization evaluation: Submit the crafted request with valid authentication credentials. The Cedar middleware authorizes the request under the less restrictive action, while Express routes it to the privileged /users list handler.
5. Access privileged data: The response returns data or performs actions associated with the more restrictive endpoint (e.g., a full user listing), completing the authorization bypass (GitHub Advisory).

• Network: HTTP GET requests to admin-only or privileged list endpoints (e.g., /users/) that include unexpected query strings (e.g., GET /users/?x=1, GET /admin/?bypass=1), particularly from non-admin user accounts.
• Logs: Application access logs showing requests to privileged path prefixes with appended query strings returning successful (2xx) responses for low-privileged users; mismatches between the Cedar authorization action logged and the actual Express route handler invoked.
• Application Behavior: Low-privileged users receiving responses containing bulk or administrative data (e.g., full user lists) that they should not be authorized to access.

The primary remediation is to upgrade @cedar-policy/authorization-for-expressjs to version 0.3.0, which fixes the issue by using req.path instead of req.originalUrl for Cedar action matching (v0.3.0 Release). As a workaround for applications that cannot immediately upgrade, validate and sanitize incoming request paths (stripping query strings) before they reach the authorization middleware. Additionally, applications should not rely solely on this middleware for authorization when defining multiple actions on overlapping path prefixes with different permission levels — implement defense-in-depth with route-level authorization checks (GitHub Advisory).

The advisory was published by AWS (the maintainer of the Cedar policy project) and security contact is routed through AWS Security (aws-security@amazon.com). Coverage has been picked up by vulnerability aggregators including Tenable, VulnDB, OSV, and GitLab Advisories, as well as security news outlets such as The Hacker Wire. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability database syndication (GitHub Advisory).