What is CVE-2026-49473?

CVE-2026-49473 is a high-severity vulnerability in Cedar-policy Authorization-for-expressjs, classified under CWE-436. CVSS score: 8.8/10. Published 2026-08-13.

How severe is CVE-2026-49473?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Cedar-policy Authorization-for-expressjs

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing…

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cedar-policy Authorization-for-expressjs — versions < 0.3.0

Weakness classification (CWE)

CWE-436
CWE-863 — Incorrect Authorization

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-49473?: CVE-2026-49473 is a high-severity vulnerability in Cedar-policy Authorization-for-expressjs, classified under CWE-436. CVSS score: 8.8/10. Published 2026-08-13.
How severe is CVE-2026-49473?: High severity. CVSS v3 base score is 8.8 out of 10.