CVE-2026-102596: CWE-862: Missing Authorization in NangoHQ nango

NangoHQ's nango product has a missing authorization vulnerability (CWE-862) affecting versions prior to 0.70.9 when RBAC is enabled with has_rbac=true. Two private API routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply web authentication but omit the necessary authorization check can({ action: 'read', resource: 'flow', scopedBy: envScope }). Consequently, a same-team user with the development_full_access role can request environment=prod and access production flow metadata or configurations despite RBAC restrictions. The vulnerability is tenant-scoped and does not allow cross-tenant access. The issue is resolved in version 0.70.9 and managed-1.5.11-0.70.8-...

An attacker with the development_full_access role within the same tenant can read production integration flow metadata or named flow configurations that should be restricted by RBAC. This exposure is limited to information disclosure (confidentiality impact) and does not affect integrity or availability. There is no cross-tenant data leakage. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low impact due to limited scope and privileges required.

Upgrade affected NangoHQ nango instances to version 0.70.9 or later, where this missing authorization vulnerability is fixed. Since this is an authorization bypass issue, applying the official patch is the recommended remediation. No alternative mitigations are indicated.