Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by decolua
CVE-2026-59800 (GCVE-0-2026-59800)
Vulnerability from nvd – Published: 2026-07-07 18:19 – Updated: 2026-07-07 19:08 X_Open Source X_Known Exploited Vulnerability
VLAI
Title
9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint
Summary
9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/decolua/9router/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/9router-os-c… | third-party-advisory |
Impacted products
Date Public
2026-05-29 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59800",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-07T19:07:58.646180Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T19:08:07.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/9router",
"product": "9router",
"repo": "https://github.com/decolua/9router",
"vendor": "decolua",
"versions": [
{
"lessThan": "0.4.44",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.4.44",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "V\u0169 Ch\u00ed Th\u00e0nh (@vcth4nh)"
},
{
"lang": "en",
"type": "reporter",
"value": "Hu\u1ef3nh \u0110\u1ee9c Tin (@Ductinn)"
}
],
"datePublic": "2026-05-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a \u0027sudo -S sh\u0027 child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC)."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T18:25:33.084Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g6g7-pvmx-m74p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/9router-os-command-injection-via-sudopassword-parameter-in-tailscale-install-endpoint"
}
],
"tags": [
"x_open-source",
"x_known-exploited-vulnerability"
],
"title": "9Router \u003c 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-59800",
"datePublished": "2026-07-07T18:19:17.154Z",
"dateReserved": "2026-07-07T14:39:14.062Z",
"dateUpdated": "2026-07-07T19:08:07.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10269 (GCVE-0-2026-10269)
Vulnerability from nvd – Published: 2026-06-01 15:15 – Updated: 2026-06-01 19:26 X_Open Source
VLAI
Title
decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
Summary
A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/367548 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/367548/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10269 | third-party-advisory |
| https://vuldb.com/submit/825188 | third-party-advisory |
| https://github.com/decolua/9router/issues/742 | issue-tracking |
| https://github.com/decolua/9router/commit/428e2c0… | patch |
| https://github.com/decolua/9router/releases/tag/v0.4.1 | patch |
| https://github.com/decolua/9router/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T19:26:23.888695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T19:26:34.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:decolua:9router:*:*:*:*:*:*:*:*"
],
"modules": [
"HTTP Header Handler"
],
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "unaffected",
"version": "0.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brad (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T15:15:09.660Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-367548 | decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/367548"
},
{
"name": "VDB-367548 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/367548/cti"
},
{
"name": "CVE-2026-10269 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10269"
},
{
"name": "Submit #825188 | decolua 9router \u003e= 0.2.72, \u003c 0.4.1 Origin Validation Error",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/825188"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/742"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/releases/tag/v0.4.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/decolua/9router/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-31T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-31T16:16:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10269",
"datePublished": "2026-06-01T15:15:09.660Z",
"dateReserved": "2026-05-31T14:09:33.434Z",
"dateUpdated": "2026-06-01T19:26:34.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5842 (GCVE-0-2026-5842)
Vulnerability from nvd – Published: 2026-04-09 04:30 – Updated: 2026-04-13 19:59
VLAI
Title
decolua 9router Administrative API Endpoint api authorization
Summary
A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/356298 | vdb-entry |
| https://vuldb.com/vuln/356298/cti | signaturepermissions-required |
| https://vuldb.com/submit/790003 | third-party-advisory |
| https://github.com/decolua/9router/issues/431 | issue-tracking |
| https://github.com/decolua/9router/issues/431#iss… | issue-tracking |
| https://github.com/deepcat1337/Free_Api_Exploit/t… | exploit |
| https://github.com/decolua/9router/releases/tag/v0.3.75 | patch |
| https://github.com/decolua/9router/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| decolua | 9router |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 Affected: 0.3.3 Affected: 0.3.4 Affected: 0.3.5 Affected: 0.3.6 Affected: 0.3.7 Affected: 0.3.8 Affected: 0.3.9 Affected: 0.3.10 Affected: 0.3.11 Affected: 0.3.12 Affected: 0.3.13 Affected: 0.3.14 Affected: 0.3.15 Affected: 0.3.16 Affected: 0.3.17 Affected: 0.3.18 Affected: 0.3.19 Affected: 0.3.20 Affected: 0.3.21 Affected: 0.3.22 Affected: 0.3.23 Affected: 0.3.24 Affected: 0.3.25 Affected: 0.3.26 Affected: 0.3.27 Affected: 0.3.28 Affected: 0.3.29 Affected: 0.3.30 Affected: 0.3.31 Affected: 0.3.32 Affected: 0.3.33 Affected: 0.3.34 Affected: 0.3.35 Affected: 0.3.36 Affected: 0.3.37 Affected: 0.3.38 Affected: 0.3.39 Affected: 0.3.40 Affected: 0.3.41 Affected: 0.3.42 Affected: 0.3.43 Affected: 0.3.44 Affected: 0.3.45 Affected: 0.3.46 Affected: 0.3.47 Unaffected: 0.3.75 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-13T19:59:13.122414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T19:59:23.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Administrative API Endpoint"
],
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
},
{
"status": "affected",
"version": "0.3.3"
},
{
"status": "affected",
"version": "0.3.4"
},
{
"status": "affected",
"version": "0.3.5"
},
{
"status": "affected",
"version": "0.3.6"
},
{
"status": "affected",
"version": "0.3.7"
},
{
"status": "affected",
"version": "0.3.8"
},
{
"status": "affected",
"version": "0.3.9"
},
{
"status": "affected",
"version": "0.3.10"
},
{
"status": "affected",
"version": "0.3.11"
},
{
"status": "affected",
"version": "0.3.12"
},
{
"status": "affected",
"version": "0.3.13"
},
{
"status": "affected",
"version": "0.3.14"
},
{
"status": "affected",
"version": "0.3.15"
},
{
"status": "affected",
"version": "0.3.16"
},
{
"status": "affected",
"version": "0.3.17"
},
{
"status": "affected",
"version": "0.3.18"
},
{
"status": "affected",
"version": "0.3.19"
},
{
"status": "affected",
"version": "0.3.20"
},
{
"status": "affected",
"version": "0.3.21"
},
{
"status": "affected",
"version": "0.3.22"
},
{
"status": "affected",
"version": "0.3.23"
},
{
"status": "affected",
"version": "0.3.24"
},
{
"status": "affected",
"version": "0.3.25"
},
{
"status": "affected",
"version": "0.3.26"
},
{
"status": "affected",
"version": "0.3.27"
},
{
"status": "affected",
"version": "0.3.28"
},
{
"status": "affected",
"version": "0.3.29"
},
{
"status": "affected",
"version": "0.3.30"
},
{
"status": "affected",
"version": "0.3.31"
},
{
"status": "affected",
"version": "0.3.32"
},
{
"status": "affected",
"version": "0.3.33"
},
{
"status": "affected",
"version": "0.3.34"
},
{
"status": "affected",
"version": "0.3.35"
},
{
"status": "affected",
"version": "0.3.36"
},
{
"status": "affected",
"version": "0.3.37"
},
{
"status": "affected",
"version": "0.3.38"
},
{
"status": "affected",
"version": "0.3.39"
},
{
"status": "affected",
"version": "0.3.40"
},
{
"status": "affected",
"version": "0.3.41"
},
{
"status": "affected",
"version": "0.3.42"
},
{
"status": "affected",
"version": "0.3.43"
},
{
"status": "affected",
"version": "0.3.44"
},
{
"status": "affected",
"version": "0.3.45"
},
{
"status": "affected",
"version": "0.3.46"
},
{
"status": "affected",
"version": "0.3.47"
},
{
"status": "unaffected",
"version": "0.3.75"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cyberthoth (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-09T04:30:17.225Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-356298 | decolua 9router Administrative API Endpoint api authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/356298"
},
{
"name": "VDB-356298 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/356298/cti"
},
{
"name": "Submit #790003 | 9Router Router 0.3.47-0.3.32 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/790003"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/431"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/431#issuecomment-4140163867"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/deepcat1337/Free_Api_Exploit/tree/main"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/releases/tag/v0.3.75"
},
{
"tags": [
"product"
],
"url": "https://github.com/decolua/9router/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-08T19:48:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "decolua 9router Administrative API Endpoint api authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5842",
"datePublished": "2026-04-09T04:30:17.225Z",
"dateReserved": "2026-04-08T17:43:46.180Z",
"dateUpdated": "2026-04-13T19:59:23.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59800 (GCVE-0-2026-59800)
Vulnerability from cvelistv5 – Published: 2026-07-07 18:19 – Updated: 2026-07-07 19:08 X_Open Source X_Known Exploited Vulnerability
VLAI
Title
9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint
Summary
9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/decolua/9router/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/9router-os-c… | third-party-advisory |
Impacted products
Date Public
2026-05-29 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59800",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-07T19:07:58.646180Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T19:08:07.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/9router",
"product": "9router",
"repo": "https://github.com/decolua/9router",
"vendor": "decolua",
"versions": [
{
"lessThan": "0.4.44",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.4.44",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "V\u0169 Ch\u00ed Th\u00e0nh (@vcth4nh)"
},
{
"lang": "en",
"type": "reporter",
"value": "Hu\u1ef3nh \u0110\u1ee9c Tin (@Ductinn)"
}
],
"datePublic": "2026-05-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a \u0027sudo -S sh\u0027 child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC)."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T18:25:33.084Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g6g7-pvmx-m74p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/9router-os-command-injection-via-sudopassword-parameter-in-tailscale-install-endpoint"
}
],
"tags": [
"x_open-source",
"x_known-exploited-vulnerability"
],
"title": "9Router \u003c 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-59800",
"datePublished": "2026-07-07T18:19:17.154Z",
"dateReserved": "2026-07-07T14:39:14.062Z",
"dateUpdated": "2026-07-07T19:08:07.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10269 (GCVE-0-2026-10269)
Vulnerability from cvelistv5 – Published: 2026-06-01 15:15 – Updated: 2026-06-01 19:26 X_Open Source
VLAI
Title
decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
Summary
A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/367548 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/367548/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10269 | third-party-advisory |
| https://vuldb.com/submit/825188 | third-party-advisory |
| https://github.com/decolua/9router/issues/742 | issue-tracking |
| https://github.com/decolua/9router/commit/428e2c0… | patch |
| https://github.com/decolua/9router/releases/tag/v0.4.1 | patch |
| https://github.com/decolua/9router/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T19:26:23.888695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T19:26:34.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:decolua:9router:*:*:*:*:*:*:*:*"
],
"modules": [
"HTTP Header Handler"
],
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "unaffected",
"version": "0.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "brad (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T15:15:09.660Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-367548 | decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/367548"
},
{
"name": "VDB-367548 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/367548/cti"
},
{
"name": "CVE-2026-10269 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10269"
},
{
"name": "Submit #825188 | decolua 9router \u003e= 0.2.72, \u003c 0.4.1 Origin Validation Error",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/825188"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/742"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/releases/tag/v0.4.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/decolua/9router/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-31T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-31T16:16:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10269",
"datePublished": "2026-06-01T15:15:09.660Z",
"dateReserved": "2026-05-31T14:09:33.434Z",
"dateUpdated": "2026-06-01T19:26:34.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5842 (GCVE-0-2026-5842)
Vulnerability from cvelistv5 – Published: 2026-04-09 04:30 – Updated: 2026-04-13 19:59
VLAI
Title
decolua 9router Administrative API Endpoint api authorization
Summary
A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/356298 | vdb-entry |
| https://vuldb.com/vuln/356298/cti | signaturepermissions-required |
| https://vuldb.com/submit/790003 | third-party-advisory |
| https://github.com/decolua/9router/issues/431 | issue-tracking |
| https://github.com/decolua/9router/issues/431#iss… | issue-tracking |
| https://github.com/deepcat1337/Free_Api_Exploit/t… | exploit |
| https://github.com/decolua/9router/releases/tag/v0.3.75 | patch |
| https://github.com/decolua/9router/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| decolua | 9router |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 Affected: 0.3.3 Affected: 0.3.4 Affected: 0.3.5 Affected: 0.3.6 Affected: 0.3.7 Affected: 0.3.8 Affected: 0.3.9 Affected: 0.3.10 Affected: 0.3.11 Affected: 0.3.12 Affected: 0.3.13 Affected: 0.3.14 Affected: 0.3.15 Affected: 0.3.16 Affected: 0.3.17 Affected: 0.3.18 Affected: 0.3.19 Affected: 0.3.20 Affected: 0.3.21 Affected: 0.3.22 Affected: 0.3.23 Affected: 0.3.24 Affected: 0.3.25 Affected: 0.3.26 Affected: 0.3.27 Affected: 0.3.28 Affected: 0.3.29 Affected: 0.3.30 Affected: 0.3.31 Affected: 0.3.32 Affected: 0.3.33 Affected: 0.3.34 Affected: 0.3.35 Affected: 0.3.36 Affected: 0.3.37 Affected: 0.3.38 Affected: 0.3.39 Affected: 0.3.40 Affected: 0.3.41 Affected: 0.3.42 Affected: 0.3.43 Affected: 0.3.44 Affected: 0.3.45 Affected: 0.3.46 Affected: 0.3.47 Unaffected: 0.3.75 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-13T19:59:13.122414Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T19:59:23.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Administrative API Endpoint"
],
"product": "9router",
"vendor": "decolua",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
},
{
"status": "affected",
"version": "0.3.3"
},
{
"status": "affected",
"version": "0.3.4"
},
{
"status": "affected",
"version": "0.3.5"
},
{
"status": "affected",
"version": "0.3.6"
},
{
"status": "affected",
"version": "0.3.7"
},
{
"status": "affected",
"version": "0.3.8"
},
{
"status": "affected",
"version": "0.3.9"
},
{
"status": "affected",
"version": "0.3.10"
},
{
"status": "affected",
"version": "0.3.11"
},
{
"status": "affected",
"version": "0.3.12"
},
{
"status": "affected",
"version": "0.3.13"
},
{
"status": "affected",
"version": "0.3.14"
},
{
"status": "affected",
"version": "0.3.15"
},
{
"status": "affected",
"version": "0.3.16"
},
{
"status": "affected",
"version": "0.3.17"
},
{
"status": "affected",
"version": "0.3.18"
},
{
"status": "affected",
"version": "0.3.19"
},
{
"status": "affected",
"version": "0.3.20"
},
{
"status": "affected",
"version": "0.3.21"
},
{
"status": "affected",
"version": "0.3.22"
},
{
"status": "affected",
"version": "0.3.23"
},
{
"status": "affected",
"version": "0.3.24"
},
{
"status": "affected",
"version": "0.3.25"
},
{
"status": "affected",
"version": "0.3.26"
},
{
"status": "affected",
"version": "0.3.27"
},
{
"status": "affected",
"version": "0.3.28"
},
{
"status": "affected",
"version": "0.3.29"
},
{
"status": "affected",
"version": "0.3.30"
},
{
"status": "affected",
"version": "0.3.31"
},
{
"status": "affected",
"version": "0.3.32"
},
{
"status": "affected",
"version": "0.3.33"
},
{
"status": "affected",
"version": "0.3.34"
},
{
"status": "affected",
"version": "0.3.35"
},
{
"status": "affected",
"version": "0.3.36"
},
{
"status": "affected",
"version": "0.3.37"
},
{
"status": "affected",
"version": "0.3.38"
},
{
"status": "affected",
"version": "0.3.39"
},
{
"status": "affected",
"version": "0.3.40"
},
{
"status": "affected",
"version": "0.3.41"
},
{
"status": "affected",
"version": "0.3.42"
},
{
"status": "affected",
"version": "0.3.43"
},
{
"status": "affected",
"version": "0.3.44"
},
{
"status": "affected",
"version": "0.3.45"
},
{
"status": "affected",
"version": "0.3.46"
},
{
"status": "affected",
"version": "0.3.47"
},
{
"status": "unaffected",
"version": "0.3.75"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cyberthoth (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-09T04:30:17.225Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-356298 | decolua 9router Administrative API Endpoint api authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/356298"
},
{
"name": "VDB-356298 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/356298/cti"
},
{
"name": "Submit #790003 | 9Router Router 0.3.47-0.3.32 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/790003"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/431"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/decolua/9router/issues/431#issuecomment-4140163867"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/deepcat1337/Free_Api_Exploit/tree/main"
},
{
"tags": [
"patch"
],
"url": "https://github.com/decolua/9router/releases/tag/v0.3.75"
},
{
"tags": [
"product"
],
"url": "https://github.com/decolua/9router/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-08T19:48:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "decolua 9router Administrative API Endpoint api authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5842",
"datePublished": "2026-04-09T04:30:17.225Z",
"dateReserved": "2026-04-08T17:43:46.180Z",
"dateUpdated": "2026-04-13T19:59:23.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}