The vulnerability resides in the authorization-for-expressjs middleware’s use of req.originalUrl, which includes the query string, when matching to Cedar action mappings. Express route matching, however, ignores the query string. This mismatch allows an attacker to manipulate the query string to force the middleware to evaluate a less restrictive policy while the request is routed to a more restrictive handler, enabling access to endpoints that should be protected. The weakness is a mismatch between request mapping and authorization enforcement, with the potential to expose data or functionality to unauthorized users. The associated CWEs are 436 (Unsound Authorization) and 863 (Mismatch Between Permission and Service Access).

Any application that incorporates cedar-policy:authorization-for-expressjs version 0.2.x or earlier and defines routes with overlapping path prefixes that have differing authorization requirements – for example, a GET /users route with an admin‑only policy and a GET /users/:id route with a less restrictive policy. Clients of the middleware using Express.js will be affected, regardless of the underlying operating system or deployment environment. The issue exists in all of the middleware’s public releases before 0.3.0; updates starting at 0.3.0 contain a fix.

With a CVSS score of 8.8 the vulnerability is considered high severity. Although no EPSS value is published, the lack of a KEV listing suggests that zero‑day exploitation is not yet documented, yet the attack surface is widely available through regular HTTP requests. An adversary can execute the exploit remotely by crafting a request that includes a query string, causing the middleware to authorize a lower‑privilege action while the web application processes the request under a stricter policy. The divergence permits unauthorized data access or operation execution. The attack vector is via standard HTTP requests; no local privilege escalation or arbitrary code execution is involved, but the potential for privilege escalation within the web application remains significant.