CVE-2026-55773 involves improper control of code generation (CWE-94) in cedar-java's toCedarExpr() method, which does not escape special characters like " or \ when converting values to Cedar source code. This allows an attacker to inject arbitrary Cedar expressions if the integrator uses toCedarExpr() to build policy text at runtime from user-controlled input. For example, injecting '|| true' into a permit clause could make the permit unconditional, or injecting '&& false' into a forbid clause could disable the forbid condition. The vulnerability affects cedar-java versions prior to 2.3.6, versions from 3.0.0 up to but not including 3.4.1, and versions from 4.0.0 up to but not including 4.9.0. Fixed versions are 2.3.6, 3.4.1, and 4.9.0.

Successful exploitation allows an attacker to inject arbitrary Cedar expressions into policy text, potentially bypassing or disabling authorization controls. This can lead to unauthorized access or denial of legitimate access, impacting confidentiality, integrity, and availability of the system relying on cedar-java for authorization decisions.

This vulnerability has been fixed in cedar-java versions 2.3.6, 3.4.1, and 4.9.0. Users should upgrade to one of these fixed versions to remediate the issue. Since no official patch or temporary fix is indicated beyond upgrading, applying the fixed versions is the recommended mitigation. Integrators should also avoid building policy text at runtime from untrusted input using toCedarExpr().