CVE-2026-102596 Details

A vulnerability exists in Nango, an open-source platform for connecting agents and products to third-party APIs, prior to version 0.70.9. On accounts with Role-Based Access Control (RBAC) enabled, two private flow-read API routes bypass the necessary access controls. A user with the 'development_full_access' role can exploit this to access production integration flow metadata and configuration details, despite being denied access on other guarded production routes. The issue arises because the affected routes apply authentication but omit the required RBAC authorization check, creating a bypass that allows unauthorized access to sensitive production data.

Users can update to Nango version 0.70.9 or the managed release 'managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a', both of which include the necessary RBAC checks on the affected routes.