This CVE exposes a contract violation in the HTTP-to-policy translation layer, not a flaw in Cedar's authorization logic itself. The middleware maps req.originalUrl to Cedar actions, but Express routing operates on the normalized path — a fundamentally different URI representation. The divergence occurs because the middleware treats query parameters as path structure, so ?x=1 appended to a route becomes an action parameter id="?x=1" that has no relationship to what Express actually routes. Cedar evaluates the correct policy for the action it receives; the problem is that the action was poisoned upstream.
The exploitation trigger is trivial: append any query string to a path that overlaps with a more-privileged route. A request to GET /users?id=anything bypasses authorization on GET /users while the middleware authorizes against a phantom GET /users/{id} action. This works because overlapping path prefixes with differing authorization levels is standard REST API design — developers following normal patterns have no reason to anticipate this failure.
The 0.3.0 patch strips query strings before mapping, but this likely addresses only the demonstrated symptom. The underlying architectural problem — using req.originalUrl as a canonical request identifier when Express never agreed to honor that representation — remains. Future divergences could emerge from path normalization, URL decoding, or case sensitivity handling in ways the normalizer doesn't anticipate.
Treat this middleware as a component requiring explicit schema validation at your application boundary. Validate and sanitize incoming request paths before they reach the authorization layer. Do not rely on the middleware alone — it solves the mapping problem for well-formed URIs but cannot defend against representation mismatches it was never designed to handle. Review your route definitions for overlapping prefixes with different authorization levels and ensure your application layer normalizes or validates URI representation before the middleware sees the request.