CVE-2026-102596 (GCVE-0-2026-102596)
Vulnerability from cvelistv5
Published
2026-10-12 21:58
Modified
2026-10-14 11:49
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Summary
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
References
Impacted products
Vendor Product Version
NangoHQ nango Version: < 0.70.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102596",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T11:47:57.376247Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T11:49:26.276Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nango",
          "vendor": "NangoHQ",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.70.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: \u0027read\u0027, resource: \u0027flow\u0027, scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T21:58:26.250Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p"
        },
        {
          "name": "https://github.com/NangoHQ/nango/pull/6603",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NangoHQ/nango/pull/6603"
        },
        {
          "name": "https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9"
        },
        {
          "name": "https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a"
        },
        {
          "name": "https://github.com/NangoHQ/nango/releases/tag/v0.70.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/NangoHQ/nango/releases/tag/v0.70.9"
        }
      ],
      "source": {
        "advisory": "GHSA-vc5r-hj76-f35p",
        "discovery": "UNKNOWN"
      },
      "title": "Nango: Production flow RBAC bypass on private flow-read routes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102596",
    "datePublished": "2026-10-12T21:58:26.250Z",
    "dateReserved": "2026-09-29T14:18:02.920Z",
    "dateUpdated": "2026-10-14T11:49:26.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-102596\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-14T11:47:57.376247Z\"}}}], \"references\": [{\"url\": \"https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-14T11:49:05.307Z\"}}], \"cna\": {\"title\": \"Nango: Production flow RBAC bypass on private flow-read routes\", \"source\": {\"advisory\": \"GHSA-vc5r-hj76-f35p\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"NangoHQ\", \"product\": \"nango\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.70.9\"}]}], \"references\": [{\"url\": \"https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p\", \"name\": \"https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/NangoHQ/nango/pull/6603\", \"name\": \"https://github.com/NangoHQ/nango/pull/6603\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9\", \"name\": \"https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a\", \"name\": \"https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/NangoHQ/nango/releases/tag/v0.70.9\", \"name\": \"https://github.com/NangoHQ/nango/releases/tag/v0.70.9\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: \u0027read\u0027, resource: \u0027flow\u0027, scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-12T21:58:26.250Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-102596\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-14T11:49:26.276Z\", \"dateReserved\": \"2026-09-29T14:18:02.920Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-10-12T21:58:26.250Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.