Search
Find a vulnerability
Search criteria
4 vulnerabilities found for 9router by decolua
CVE-2026-10269 (GCVE-0-2026-10269)
Vulnerability from nvd – Published: 2026-06-01 15:15 – Updated: 2026-06-01 19:26 X_Open Source
VLAI
Title
decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
Summary
A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/367548 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/367548/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10269 | third-party-advisory |
| https://vuldb.com/submit/825188 | third-party-advisory |
| https://github.com/decolua/9router/issues/742 | issue-tracking |
| https://github.com/decolua/9router/commit/428e2c0… | patch |
| https://github.com/decolua/9router/releases/tag/v0.4.1 | patch |
| https://github.com/decolua/9router/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T19:26:23.888695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T19:26:34.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:decolua:9router:*:*:*:*:*:*:*:*"
],
"modules": [
"HTTP Header Handler"
],
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "unaffected",
"version": "0.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brad (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T15:15:09.660Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-367548 | decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/367548"
},
{
"name": "VDB-367548 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/367548/cti"
},
{
"name": "CVE-2026-10269 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10269"
},
{
"name": "Submit #825188 | decolua 9router \u003e= 0.2.72, \u003c 0.4.1 Origin Validation Error",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/825188"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/742"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/releases/tag/v0.4.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/decolua/9router/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-31T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-31T16:16:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10269",
"datePublished": "2026-06-01T15:15:09.660Z",
"dateReserved": "2026-05-31T14:09:33.434Z",
"dateUpdated": "2026-06-01T19:26:34.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5842 (GCVE-0-2026-5842)
Vulnerability from nvd – Published: 2026-04-09 04:30 – Updated: 2026-04-13 19:59
VLAI
Title
decolua 9router Administrative API Endpoint api authorization
Summary
A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/356298 | vdb-entry |
| https://vuldb.com/vuln/356298/cti | signaturepermissions-required |
| https://vuldb.com/submit/790003 | third-party-advisory |
| https://github.com/decolua/9router/issues/431 | issue-tracking |
| https://github.com/decolua/9router/issues/431#iss… | issue-tracking |
| https://github.com/deepcat1337/Free_Api_Exploit/t… | exploit |
| https://github.com/decolua/9router/releases/tag/v0.3.75 | patch |
| https://github.com/decolua/9router/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| decolua | 9router |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 Affected: 0.3.3 Affected: 0.3.4 Affected: 0.3.5 Affected: 0.3.6 Affected: 0.3.7 Affected: 0.3.8 Affected: 0.3.9 Affected: 0.3.10 Affected: 0.3.11 Affected: 0.3.12 Affected: 0.3.13 Affected: 0.3.14 Affected: 0.3.15 Affected: 0.3.16 Affected: 0.3.17 Affected: 0.3.18 Affected: 0.3.19 Affected: 0.3.20 Affected: 0.3.21 Affected: 0.3.22 Affected: 0.3.23 Affected: 0.3.24 Affected: 0.3.25 Affected: 0.3.26 Affected: 0.3.27 Affected: 0.3.28 Affected: 0.3.29 Affected: 0.3.30 Affected: 0.3.31 Affected: 0.3.32 Affected: 0.3.33 Affected: 0.3.34 Affected: 0.3.35 Affected: 0.3.36 Affected: 0.3.37 Affected: 0.3.38 Affected: 0.3.39 Affected: 0.3.40 Affected: 0.3.41 Affected: 0.3.42 Affected: 0.3.43 Affected: 0.3.44 Affected: 0.3.45 Affected: 0.3.46 Affected: 0.3.47 Unaffected: 0.3.75 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-13T19:59:13.122414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T19:59:23.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Administrative API Endpoint"
],
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
},
{
"status": "affected",
"version": "0.3.3"
},
{
"status": "affected",
"version": "0.3.4"
},
{
"status": "affected",
"version": "0.3.5"
},
{
"status": "affected",
"version": "0.3.6"
},
{
"status": "affected",
"version": "0.3.7"
},
{
"status": "affected",
"version": "0.3.8"
},
{
"status": "affected",
"version": "0.3.9"
},
{
"status": "affected",
"version": "0.3.10"
},
{
"status": "affected",
"version": "0.3.11"
},
{
"status": "affected",
"version": "0.3.12"
},
{
"status": "affected",
"version": "0.3.13"
},
{
"status": "affected",
"version": "0.3.14"
},
{
"status": "affected",
"version": "0.3.15"
},
{
"status": "affected",
"version": "0.3.16"
},
{
"status": "affected",
"version": "0.3.17"
},
{
"status": "affected",
"version": "0.3.18"
},
{
"status": "affected",
"version": "0.3.19"
},
{
"status": "affected",
"version": "0.3.20"
},
{
"status": "affected",
"version": "0.3.21"
},
{
"status": "affected",
"version": "0.3.22"
},
{
"status": "affected",
"version": "0.3.23"
},
{
"status": "affected",
"version": "0.3.24"
},
{
"status": "affected",
"version": "0.3.25"
},
{
"status": "affected",
"version": "0.3.26"
},
{
"status": "affected",
"version": "0.3.27"
},
{
"status": "affected",
"version": "0.3.28"
},
{
"status": "affected",
"version": "0.3.29"
},
{
"status": "affected",
"version": "0.3.30"
},
{
"status": "affected",
"version": "0.3.31"
},
{
"status": "affected",
"version": "0.3.32"
},
{
"status": "affected",
"version": "0.3.33"
},
{
"status": "affected",
"version": "0.3.34"
},
{
"status": "affected",
"version": "0.3.35"
},
{
"status": "affected",
"version": "0.3.36"
},
{
"status": "affected",
"version": "0.3.37"
},
{
"status": "affected",
"version": "0.3.38"
},
{
"status": "affected",
"version": "0.3.39"
},
{
"status": "affected",
"version": "0.3.40"
},
{
"status": "affected",
"version": "0.3.41"
},
{
"status": "affected",
"version": "0.3.42"
},
{
"status": "affected",
"version": "0.3.43"
},
{
"status": "affected",
"version": "0.3.44"
},
{
"status": "affected",
"version": "0.3.45"
},
{
"status": "affected",
"version": "0.3.46"
},
{
"status": "affected",
"version": "0.3.47"
},
{
"status": "unaffected",
"version": "0.3.75"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cyberthoth (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-09T04:30:17.225Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-356298 | decolua 9router Administrative API Endpoint api authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/356298"
},
{
"name": "VDB-356298 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/356298/cti"
},
{
"name": "Submit #790003 | 9Router Router 0.3.47-0.3.32 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/790003"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/431"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/431#issuecomment-4140163867"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/deepcat1337/Free_Api_Exploit/tree/main"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/releases/tag/v0.3.75"
},
{
"tags": [
"product"
],
"url": "https://github.com/decolua/9router/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-08T19:48:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "decolua 9router Administrative API Endpoint api authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5842",
"datePublished": "2026-04-09T04:30:17.225Z",
"dateReserved": "2026-04-08T17:43:46.180Z",
"dateUpdated": "2026-04-13T19:59:23.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10269 (GCVE-0-2026-10269)
Vulnerability from cvelistv5 – Published: 2026-06-01 15:15 – Updated: 2026-06-01 19:26 X_Open Source
VLAI
Title
decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
Summary
A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/367548 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/367548/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10269 | third-party-advisory |
| https://vuldb.com/submit/825188 | third-party-advisory |
| https://github.com/decolua/9router/issues/742 | issue-tracking |
| https://github.com/decolua/9router/commit/428e2c0… | patch |
| https://github.com/decolua/9router/releases/tag/v0.4.1 | patch |
| https://github.com/decolua/9router/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T19:26:23.888695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T19:26:34.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:decolua:9router:*:*:*:*:*:*:*:*"
],
"modules": [
"HTTP Header Handler"
],
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "unaffected",
"version": "0.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brad (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T15:15:09.660Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-367548 | decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/367548"
},
{
"name": "VDB-367548 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/367548/cti"
},
{
"name": "CVE-2026-10269 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10269"
},
{
"name": "Submit #825188 | decolua 9router \u003e= 0.2.72, \u003c 0.4.1 Origin Validation Error",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/825188"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/742"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/releases/tag/v0.4.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/decolua/9router/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-31T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-31T16:16:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10269",
"datePublished": "2026-06-01T15:15:09.660Z",
"dateReserved": "2026-05-31T14:09:33.434Z",
"dateUpdated": "2026-06-01T19:26:34.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5842 (GCVE-0-2026-5842)
Vulnerability from cvelistv5 – Published: 2026-04-09 04:30 – Updated: 2026-04-13 19:59
VLAI
Title
decolua 9router Administrative API Endpoint api authorization
Summary
A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/356298 | vdb-entry |
| https://vuldb.com/vuln/356298/cti | signaturepermissions-required |
| https://vuldb.com/submit/790003 | third-party-advisory |
| https://github.com/decolua/9router/issues/431 | issue-tracking |
| https://github.com/decolua/9router/issues/431#iss… | issue-tracking |
| https://github.com/deepcat1337/Free_Api_Exploit/t… | exploit |
| https://github.com/decolua/9router/releases/tag/v0.3.75 | patch |
| https://github.com/decolua/9router/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| decolua | 9router |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 Affected: 0.3.3 Affected: 0.3.4 Affected: 0.3.5 Affected: 0.3.6 Affected: 0.3.7 Affected: 0.3.8 Affected: 0.3.9 Affected: 0.3.10 Affected: 0.3.11 Affected: 0.3.12 Affected: 0.3.13 Affected: 0.3.14 Affected: 0.3.15 Affected: 0.3.16 Affected: 0.3.17 Affected: 0.3.18 Affected: 0.3.19 Affected: 0.3.20 Affected: 0.3.21 Affected: 0.3.22 Affected: 0.3.23 Affected: 0.3.24 Affected: 0.3.25 Affected: 0.3.26 Affected: 0.3.27 Affected: 0.3.28 Affected: 0.3.29 Affected: 0.3.30 Affected: 0.3.31 Affected: 0.3.32 Affected: 0.3.33 Affected: 0.3.34 Affected: 0.3.35 Affected: 0.3.36 Affected: 0.3.37 Affected: 0.3.38 Affected: 0.3.39 Affected: 0.3.40 Affected: 0.3.41 Affected: 0.3.42 Affected: 0.3.43 Affected: 0.3.44 Affected: 0.3.45 Affected: 0.3.46 Affected: 0.3.47 Unaffected: 0.3.75 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-13T19:59:13.122414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T19:59:23.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Administrative API Endpoint"
],
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
},
{
"status": "affected",
"version": "0.3.3"
},
{
"status": "affected",
"version": "0.3.4"
},
{
"status": "affected",
"version": "0.3.5"
},
{
"status": "affected",
"version": "0.3.6"
},
{
"status": "affected",
"version": "0.3.7"
},
{
"status": "affected",
"version": "0.3.8"
},
{
"status": "affected",
"version": "0.3.9"
},
{
"status": "affected",
"version": "0.3.10"
},
{
"status": "affected",
"version": "0.3.11"
},
{
"status": "affected",
"version": "0.3.12"
},
{
"status": "affected",
"version": "0.3.13"
},
{
"status": "affected",
"version": "0.3.14"
},
{
"status": "affected",
"version": "0.3.15"
},
{
"status": "affected",
"version": "0.3.16"
},
{
"status": "affected",
"version": "0.3.17"
},
{
"status": "affected",
"version": "0.3.18"
},
{
"status": "affected",
"version": "0.3.19"
},
{
"status": "affected",
"version": "0.3.20"
},
{
"status": "affected",
"version": "0.3.21"
},
{
"status": "affected",
"version": "0.3.22"
},
{
"status": "affected",
"version": "0.3.23"
},
{
"status": "affected",
"version": "0.3.24"
},
{
"status": "affected",
"version": "0.3.25"
},
{
"status": "affected",
"version": "0.3.26"
},
{
"status": "affected",
"version": "0.3.27"
},
{
"status": "affected",
"version": "0.3.28"
},
{
"status": "affected",
"version": "0.3.29"
},
{
"status": "affected",
"version": "0.3.30"
},
{
"status": "affected",
"version": "0.3.31"
},
{
"status": "affected",
"version": "0.3.32"
},
{
"status": "affected",
"version": "0.3.33"
},
{
"status": "affected",
"version": "0.3.34"
},
{
"status": "affected",
"version": "0.3.35"
},
{
"status": "affected",
"version": "0.3.36"
},
{
"status": "affected",
"version": "0.3.37"
},
{
"status": "affected",
"version": "0.3.38"
},
{
"status": "affected",
"version": "0.3.39"
},
{
"status": "affected",
"version": "0.3.40"
},
{
"status": "affected",
"version": "0.3.41"
},
{
"status": "affected",
"version": "0.3.42"
},
{
"status": "affected",
"version": "0.3.43"
},
{
"status": "affected",
"version": "0.3.44"
},
{
"status": "affected",
"version": "0.3.45"
},
{
"status": "affected",
"version": "0.3.46"
},
{
"status": "affected",
"version": "0.3.47"
},
{
"status": "unaffected",
"version": "0.3.75"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cyberthoth (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-09T04:30:17.225Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-356298 | decolua 9router Administrative API Endpoint api authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/356298"
},
{
"name": "VDB-356298 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/356298/cti"
},
{
"name": "Submit #790003 | 9Router Router 0.3.47-0.3.32 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/790003"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/431"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/431#issuecomment-4140163867"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/deepcat1337/Free_Api_Exploit/tree/main"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/releases/tag/v0.3.75"
},
{
"tags": [
"product"
],
"url": "https://github.com/decolua/9router/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-08T19:48:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "decolua 9router Administrative API Endpoint api authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5842",
"datePublished": "2026-04-09T04:30:17.225Z",
"dateReserved": "2026-04-08T17:43:46.180Z",
"dateUpdated": "2026-04-13T19:59:23.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}