Threats affecting pkg:github/nangohq/nango

NangoHQ nango versions prior to 0.70.9 contain a missing authorization vulnerability (CWE-862) in two private flow-read API routes. On accounts with RBAC enabled, users with the development_full_access role can bypass production role boundaries within the same tenant and read production integration flow metadata or named flow configurations. This issue does not allow cross-tenant access. The vulnerability is fixed in version 0.70.9.

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.