6 matches found
CVE-2026-102596
Prior to version 0.70.9 , the Nango platform contained an RBAC bypass affecting accounts with has_rbac=true. The vulnerability exists because two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, failed to include the necessary can authori...
CVE-2026-102596 Nango: Production flow RBAC bypass on private flow-read routes
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with hasrbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth b...
CVE-2026-102596
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with hasrbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth b...
CVE-2026-102596 Nango: Production flow RBAC bypass on private flow-read routes
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with hasrbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth b...
CVE-2026-102596 Nango: Production flow RBAC bypass on private flow-read routes
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with hasrbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth b...
PT-2026-110978
Name of the Vulnerable Software and Affected Versions Nango versions prior to 0.70.9 Description On accounts with Role-Based Access Control RBAC enabled via a plan where has rbac is set to true, certain private flow-read routes fail to properly enforce authorization checks. Specifically, the...