@cedar-policy/authorization-for-expressjs is an Express.js middleware that maps HTTP requests to Cedar authorization actions. The vulnerability arises because the middleware matches requests using req.originalUrl (including query strings), whereas Express routing uses only the path component. This discrepancy can be exploited when an application defines different authorization requirements for overlapping paths (e.g., GET /users with admin-only access and GET /users/{id} with less restrictive access). An attacker can append a query string to a request to cause the middleware to authorize against a less restrictive action while Express routes the request to the more restrictive handler, effectively bypassing authorization controls. Versions prior to 0.3.0 are affected. The issue is fixed in version 0.3.0.

An attacker with at least low privilege can bypass stricter authorization policies by manipulating query strings in requests. This leads to unauthorized access to resources that should be restricted, potentially exposing sensitive data or functionality. The vulnerability affects confidentiality, integrity, and availability as unauthorized actions may be performed.

Upgrade to @cedar-policy/authorization-for-expressjs version 0.3.0 or later, where this issue is fixed. Additionally, validate and sanitize incoming request paths before they reach the authorization middleware. Avoid relying solely on this middleware for authorization when defining multiple actions on overlapping path prefixes with different permission levels.