CVE-2026-102596

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a

• CWE-862

• https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9
• https://github.com/NangoHQ/nango/pull/6603
• https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
• https://github.com/NangoHQ/nango/releases/tag/v0.70.9
• https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p
• https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p

Published

Oct 12, 2026

Last Modified

Oct 14, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102585A flaw was found in Moodle. When enrolling a user into a cou…4.3
• CVE-2026-102586A flaw was found in Moodle. Insufficient sanitization of use…6.1
• CVE-2026-102587A flaw was found in Moodle. User list filters do not properl…2.7
• CVE-2026-102588A flaw was found in Moodle. The XML grade import feature lac…6.5
• CVE-2026-10259A security vulnerability has been detected in H3C Magic B0 u…8.8
• CVE-2026-102590IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote a…7.7
• CVE-2026-102598Werkzeug is a comprehensive WSGI web application library. Pr…6.3
• CVE-2026-102599Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-10260A vulnerability was detected in CodeAstro Online Job Portal …7.3
• CVE-2026-102600Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-102601Flysystem is an open source file storage library for PHP. Pr…3.5
• CVE-2026-102603Gotify server is a simple server for sending and receiving m…5.3