Technical impact
A missing authorization check allows a same‑team user with the development_full_access role to retrieve production integration flow metadata or named flow configuration by specifying env=prod in the request. The vulnerability is a classic read‑confidentiality breach and is classified as CWE-862. It does not provide privilege escalation or code execution, but exposes sensitive configuration data. The impact is primarily confidentiality loss for production flows.
Affected Systems
The affected product is Nango, an open‑source platform for connecting agents and products to third‑party APIs. Versions before 0.70.9 and the managed build prior to managed‑1.5.11‑0.70.8 are vulnerable. New releases from 0.70.9 onward and the patched managed build address the issue.
Risk and Exploitability
The CVSS score is 4.3, indicating moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. An attacker must have an account on a tenant with RBAC enabled and hold a same‑team role granting development_full_access. By exploiting the bypass, the attacker can read production flow data without crossing tenant boundaries. The attack vector is likely internal exploitation or compromised user credentials; network exposure is not required.
