Detections
Analytics

SCA: security update for @cedar-policy/authorization-for-expressjs (GHSA-g4w6-vmgf-xqvx)

high Tenable Self-Hosted Container Security Plugin ID 444154

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar
 authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating
 authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issue where,
 under certain circumstances, the middleware matches incoming requests against Cedar action mappings using
 req.originalUrl, which includes the query string, while Express routes requests using only the path
 component. The middleware uses req.originalUrl to match incoming requests against Cedar action mappings.
 In Express, req.originalUrl includes the query string, while route matching uses only the path. This
 creates a divergence between what Cedar authorizes and what Express executes. When an application defines
 separate actions for overlapping path prefixes with different authorization requirements (for example, GET
 /users for listing all users with admin-only access, and GET /users/{id} for retrieving a single user with
 any authenticated user access), an actor can append a query string to bypass the more restrictive policy.
 Sending GET /users/?x=1 causes the middleware to match against /users/{id} (with id parameter set to ?x=1)
 and evaluate the less restrictive action, while Express routes the request to the /users list handler.
 This allows inappropriate access to the more restrictive endpoint. This issue has been addressed in
 version 0.30. Some workarounds are available. Validate and sanitize incoming request paths before they
 reach the authorization middleware. Ensure that applications do not rely solely on the middleware for
 authorization when defining multiple actions on overlapping path prefixes with different permission
 levels. (CVE-2026-49473)

Solution

Update the @cedar-policy/authorization-for-expressjs library and its related packages to version 0.3.0 or later.

See Also

https://github.com/advisories/GHSA-g4w6-vmgf-xqvx

Plugin Details

Severity: High

ID: 444154

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 6/30/2026

Updated: 8/14/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.03

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-49473

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/30/2026

Vulnerability Publication Date: 6/30/2026

Reference Information

CVE: CVE-2026-49473