CVE-2026-62328 Details
Description
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.
A vulnerability allowing unauthenticated information disclosure has been identified in 9Router versions through 0.4.41. This issue enables remote attackers to access sensitive user data by sending requests to API endpoints that lack proper authentication. Exploitation of this vulnerability allows for the enumeration of paginated request logs and the retrieval of complete AI conversation histories, including system prompts, user messages, assistant responses, tool calls, and user email addresses, by querying the request-logs and request-details API routes.
As of now, there is no official patch available for this vulnerability. However, it is recommended to add authentication middleware to all affected API routes and to implement proper authorization checks to ensure users can only access their own data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 | CISA-ADP | AdvisoryBundleExploitRemedyVendor |
| https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 | [email protected] | AdvisoryBundleExploitRemedyVendor |
| https://www.vulncheck.com/advisories/9router-unauthenticated-information-disclosure-via-api-usage-endpoints | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 9Router | <= 0.4.41 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |