CVE-2026-62328 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints
Remote attackers can access sensitive AI conversation histories and user emails via unprotected API endpoints in 9Router.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62328?
CVE-2026-62328 is a high-severity missing authorization vulnerability in decolua 9Router, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.
Which versions are affected by CVE-2026-62328?
How do I fix CVE-2026-62328?
No fix has been published for CVE-2026-62328 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-62328 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62328 exists.
Sources
Also known as GHSA-xjwv-xjj9-gqqc.