CVE-2026-49473 Overview
CVE-2026-49473 is an authorization bypass vulnerability in @cedar-policy/authorization-for-expressjs, an open-source Express.js middleware that integrates Cedar policy evaluation into Express applications. Versions prior to 0.3.0 match incoming requests against Cedar action mappings using req.originalUrl, which includes the query string. Express itself routes requests using only the path component. Attackers can exploit this divergence by appending a query string to force the middleware to evaluate a less restrictive Cedar action than the one Express ultimately executes. The issue is classified under [CWE-436] (Interpretation Conflict).
Critical Impact
An authenticated actor can bypass restrictive Cedar authorization policies on overlapping route prefixes, gaining access to endpoints reserved for higher-privileged users.
Affected Products
- @cedar-policy/authorization-for-expressjs versions prior to 0.3.0
- Express.js applications using Cedar middleware with overlapping path prefixes
- Applications defining separate Cedar actions for list and item routes with different permission levels
Discovery Timeline
- 2026-08-13 - CVE-2026-49473 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-49473
Vulnerability Analysis
The middleware performs Cedar action lookup using req.originalUrl, the unparsed request target that retains the query string. Express, in contrast, dispatches to route handlers using only the path portion of the URL. This produces two different views of the same request: one used for authorization, another used for execution.
When an application defines separate actions for overlapping prefixes, an attacker can pick which action Cedar evaluates. Consider a policy where GET /users requires admin privileges to list all users, while GET /users/{id} allows any authenticated user to fetch a single record. A request to GET /users/?x=1 causes the middleware to interpret ?x=1 as the {id} path parameter and evaluate the less restrictive per-user action. Express then strips the query and routes the request to the /users list handler, returning the full user list.
Root Cause
The root cause is an interpretation conflict between two parsers. The Cedar middleware treats req.originalUrl as a routing input without normalizing away the query string. Express uses the parsed pathname. The mismatch violates the assumption that Cedar authorizes exactly the handler Express will invoke.
Attack Vector
Exploitation requires network access to the Express application and valid low-privilege credentials to satisfy any preceding authentication middleware. The attacker crafts a request whose path prefix collides with a more restrictive route but includes a trailing segment and query string that map to a permissive Cedar action. Refer to the GitHub Security Advisory GHSA-g4w6-vmgf-xqvx for the canonical technical description.
Detection Methods for CVE-2026-49473
Indicators of Compromise
- HTTP request logs containing paths with trailing slashes followed by query strings on collection endpoints, such as GET /users/?x=1 or GET /orders/?filter=1.
- Access log entries where a low-privilege session successfully retrieves responses from endpoints normally reserved for administrative roles.
- Cedar policy decision logs recording evaluation of item-scoped actions for requests whose executed handler is a list or collection route.
Detection Strategies
- Correlate Cedar action decisions with the Express handler that served the response and alert on mismatches between authorized action and executed route.
- Inspect HTTP access logs for requests where the path contains a query string preceded by a trailing slash on routes with known authorization tiers.
- Review application dependency manifests for @cedar-policy/authorization-for-expressjs at versions below 0.3.0.
Monitoring Recommendations
- Instrument the middleware to log both req.originalUrl and req.path for each authorization decision to surface parser divergence.
- Emit metrics for unusual query-string patterns on RESTful collection endpoints and route them to the SOC pipeline.
- Track unauthorized-to-authorized transition patterns per user session to identify privilege escalation attempts.
How to Mitigate CVE-2026-49473
Immediate Actions Required
- Upgrade @cedar-policy/authorization-for-expressjs to version 0.3.0 or later across all Express deployments.
- Audit Cedar policy files for overlapping path prefixes with divergent permission requirements and identify high-risk route pairs.
- Review recent access logs on impacted endpoints for suspicious requests containing query strings on collection routes.
Patch Information
The fix is available in GitHub Release v0.3.0. The maintainers addressed the interpretation conflict by aligning the middleware's request matching with the path used by Express routing. Update the dependency in package.json and redeploy affected services.
Workarounds
- Validate and sanitize incoming request paths in middleware executed before the Cedar authorization layer, stripping query strings from the value used for action mapping.
- Avoid defining multiple Cedar actions on overlapping path prefixes with different permission levels until the upgrade is applied.
- Implement handler-level authorization checks as a defense-in-depth control so that Express route handlers do not rely solely on middleware decisions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
