CVE-2026-9371 Details

A vulnerability exists in ItzCrazyKns Vane versions through 1.12.1, where the API component's route.ts file lacks proper authentication. This oversight allows remote attackers to access sensitive functionalities without authorization. The vulnerability's complexity is high, making exploitation challenging, although it has been publicly disclosed and could be utilized once basic authentication is implemented.

To address this vulnerability, it is recommended to add authentication middleware to the API routes, implement role-based access control, and separate public and private configuration data. Additionally, encrypting sensitive information at rest and conducting an audit of the application's API endpoints for similar vulnerabilities would be beneficial.