CVE-2026-62328highCWE-359CWE-862

CVE-2026-62328: high-severity vulnerability in decolua 9Router

9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints

Published · Updated

Follow this CVE+ Monitor 9router+ Monitor 9router

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
decolua · 9Router
Related CVEs — decolua 9Router

In the same product, most dangerous first.

CVE-2026-62327CRITICAL9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/statsEPSS 6.3%CVE-2026-59801CRITICAL9Router 0.4.41 - Unauthenticated API Exposure via /api/providersEPSS 2.6%CVE-2026-103530MEDIUMdecolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgeryEPSS 0.3%