{"action":"Upgrade @cedar-policy/authorization-for-expressjs to 0.3.0 or later.","affected":[{"fixed":"0.3.0","introduced":"0"}],"component":"@cedar-policy/authorization-for-expressjs","cve_ids":["CVE-2026-49473"],"ecosystem":"npm","epss":0.00469,"exploited":false,"fixed_versions":["0.3.0"],"ghsa_id":"GHSA-g4w6-vmgf-xqvx","id":"tcs_01M5KFQ2ZHAVTWYTM381Q7DTHE","modified_at":"2026-09-10T03:50:49.534958287Z","published_at":"2026-06-30T18:09:13Z","references":["https://osv.dev/vulnerability/GHSA-g4w6-vmgf-xqvx","https://github.com/cedar-policy/authorization-for-expressjs/security/advisories/GHSA-g4w6-vmgf-xqvx","https://github.com/cedar-policy/authorization-for-expressjs","https://github.com/cedar-policy/authorization-for-expressjs/releases/tag/v0.3.0"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-g4w6-vmgf-xqvx","url":"https://osv.dev/vulnerability/GHSA-g4w6-vmgf-xqvx"}],"summary":"@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation"}