CVE-2026-56679 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
Authenticated users can downgrade security settings via mass assignment, exposing protected API routes to unauthenticated access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56679?
CVE-2026-56679 is a high-severity missing authorization vulnerability in decolua 9router, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.
Weakness: CWE-915
Which versions are affected by CVE-2026-56679?
2 open source packages ship an affected version, including 9router.
| Package | Affected | Fixed in |
|---|---|---|
9router npm | All versions | 0.5.4 |
9router npm | All versions | 0.5.4 |
How do I fix CVE-2026-56679?
Upgrade 9router to 0.5.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56679 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56679 exists.
Sources
Also known as GHSA-vmjq-hvgq-2wv4.