Vulnerability-Lookup

CVE-2026-55500 (GCVE-0-2026-55500)

Vulnerability from cvelistv5 – Published: 2026-07-10 15:28 – Updated: 2026-07-10 15:41

Title

9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover

Summary

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 15:39 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/decolua/9router/security/advis…	x_refsource_CONFIRM
https://github.com/decolua/9router/commit/0c7c9de…	x_refsource_MISC
https://github.com/decolua/9router/releases/tag/v0.4.80	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
decolua	9router	Affected: < 0.4.80	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55500",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T15:39:22.455445Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T15:41:31.178Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "9router",
          "vendor": "decolua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.80"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "9Router is an AI router \u0026 token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T15:31:16.352Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx"
        },
        {
          "name": "https://github.com/decolua/9router/commit/0c7c9de00ae3ab81d6580e3cc368483c4c03f6fd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/commit/0c7c9de00ae3ab81d6580e3cc368483c4c03f6fd"
        },
        {
          "name": "https://github.com/decolua/9router/releases/tag/v0.4.80",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/releases/tag/v0.4.80"
        }
      ],
      "source": {
        "advisory": "GHSA-qvfm-67h2-2qfx",
        "discovery": "UNKNOWN"
      },
      "title": "9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55500",
    "datePublished": "2026-07-10T15:28:27.620Z",
    "dateReserved": "2026-06-16T22:28:27.062Z",
    "dateUpdated": "2026-07-10T15:41:31.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55500",
      "date": "2026-09-15",
      "epss": "0.00685",
      "percentile": "0.50731"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55500\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-10T16:16:33.357\",\"lastModified\":\"2026-07-10T17:25:46.957\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"9Router is an AI router \u0026 token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"decolua\",\"product\":\"9router\",\"versions\":[{\"version\":\"\u003c 0.4.80\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-10T15:39:22.455445Z\",\"id\":\"CVE-2026-55500\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://github.com/decolua/9router/commit/0c7c9de00ae3ab81d6580e3cc368483c4c03f6fd\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decolua/9router/releases/tag/v0.4.80\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55500\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-10T15:39:22.455445Z\"}}}], \"references\": [{\"url\": \"https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-10T15:39:14.921Z\"}}], \"cna\": {\"title\": \"9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover\", \"source\": {\"advisory\": \"GHSA-qvfm-67h2-2qfx\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"decolua\", \"product\": \"9router\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.4.80\"}]}], \"references\": [{\"url\": \"https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx\", \"name\": \"https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/decolua/9router/commit/0c7c9de00ae3ab81d6580e3cc368483c4c03f6fd\", \"name\": \"https://github.com/decolua/9router/commit/0c7c9de00ae3ab81d6580e3cc368483c4c03f6fd\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/decolua/9router/releases/tag/v0.4.80\", \"name\": \"https://github.com/decolua/9router/releases/tag/v0.4.80\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"9Router is an AI router \u0026 token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-10T15:31:16.352Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55500\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-10T15:41:31.178Z\", \"dateReserved\": \"2026-06-16T22:28:27.062Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-10T15:28:27.620Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55500

Vulnerability from fkie_nvd - Published: 2026-07-10 16:16 - Updated: 2026-07-10 17:25

Severity

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/decolua/9router/commit/0c7c9de00ae3ab81d6580e3cc368483c4c03f6fd
	security-advisories@github.com	https://github.com/decolua/9router/releases/tag/v0.4.80
	security-advisories@github.com	https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "9router",
          "vendor": "decolua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.80"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "9Router is an AI router \u0026 token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80."
    }
  ],
  "id": "CVE-2026-55500",
  "lastModified": "2026-07-10T17:25:46.957",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55500",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-10T15:39:22.455445Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-10T16:16:33.357",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decolua/9router/commit/0c7c9de00ae3ab81d6580e3cc368483c4c03f6fd"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decolua/9router/releases/tag/v0.4.80"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QVFM-67H2-2QFX

Vulnerability from github – Published: 2026-07-06 21:37 – Updated: 2026-07-06 21:37

Summary

9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

Details

Summary

The /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. Combined with other vulnerabilities (e.g., default password, tunnel exposure), this enables complete database takeover.

Description

The endpoint /api/settings/database is listed in ALWAYS_PROTECTED in dashboardGuard.js (line 42), which requires a valid JWT token or CLI token. However, this protection is insufficient because:

GET (Export): Returns the complete database including API keys (key field in apiKeys table), OAuth tokens, and all provider credentials. Line 80 in src/lib/db/index.js: apiKeys: db.all("SELECT * FROM apiKeys").map(...) — the key field contains the plaintext API key value.
POST (Import): Accepts arbitrary JSON and performs a complete database wipe-and-replace in a transaction (lines 102-163 in src/lib/db/index.js). This replaces all settings including the password hash, effectively allowing an attacker to set their own password.
The exported data includes apiKeys with their plaintext key values, providerConnections with all OAuth tokens, and settings with OIDC client secrets.

Evidence

File: src/app/api/settings/database/route.js

export async function GET() {
  const payload = await exportDb();
  return NextResponse.json(payload);
}

export async function POST(request) {
  const payload = await request.json();
  await importDb(payload);
  // ...
}

File: src/lib/db/index.js (lines 96-163)

export async function importDb(payload) {
  db.transaction(() => {
    // Wipe all tables
    db.run(`DELETE FROM settings`);
    db.run(`DELETE FROM providerConnections`);
    db.run(`DELETE FROM providerNodes`);
    db.run(`DELETE FROM proxyPools`);
    db.run(`DELETE FROM apiKeys`);
    db.run(`DELETE FROM combos`);
    db.run(`DELETE FROM kv WHERE scope IN (...)`);
    // Then insert attacker-controlled data
    // ...
  });
}

The exportDb function at line 80 exposes API key plaintext:

apiKeys: db.all(`SELECT * FROM apiKeys`).map((r) => ({ 
  id: r.id, key: r.key, name: r.name, ...
})),

Steps to Reproduce

Authenticate with any valid JWT (e.g., using the default password "123456")
Export: curl -b auth_token=<jwt> http://localhost:20128/api/settings/database
Observe: Full database dump with all credentials in plaintext
Import malicious data: curl -X POST -b auth_token=<jwt> -H "Content-Type: application/json" -d '<modified-db>' http://localhost:20128/api/settings/database
All settings, passwords, API keys are now replaced with attacker-controlled values

Impact

Confidentiality: Complete exposure of all stored secrets (API keys, OAuth tokens, OIDC client secrets)
Integrity: Complete database replacement with attacker-controlled data
Availability: Database wipe is possible by importing an empty database
Scope Changed: Importing new settings affects all users and downstream services

Recommended Fix

Require re-authentication for database export/import (not just an existing session)
Mask/redact API keys in export (or require explicit opt-in for key export)
Add confirmation step for import (require current password verification)
Implement database backup before import
Log all export/import operations with audit trail

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "9router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.4.71"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55500"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T21:37:49Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe `/api/settings/database` endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the `ALWAYS_PROTECTED` middleware check, which only validates JWT or CLI token. Combined with other vulnerabilities (e.g., default password, tunnel exposure), this enables complete database takeover.\n\n## Description\n\nThe endpoint `/api/settings/database` is listed in `ALWAYS_PROTECTED` in `dashboardGuard.js` (line 42), which requires a valid JWT token or CLI token. However, this protection is insufficient because:\n\n1. **GET (Export):** Returns the complete database including API keys (`key` field in `apiKeys` table), OAuth tokens, and all provider credentials. Line 80 in `src/lib/db/index.js`: `apiKeys: db.all(\"SELECT * FROM apiKeys\").map(...)` \u2014 the `key` field contains the plaintext API key value.\n\n2. **POST (Import):** Accepts arbitrary JSON and performs a complete database wipe-and-replace in a transaction (lines 102-163 in `src/lib/db/index.js`). This replaces all settings including the password hash, effectively allowing an attacker to set their own password.\n\n3. The exported data includes `apiKeys` with their plaintext `key` values, `providerConnections` with all OAuth tokens, and `settings` with OIDC client secrets.\n\n### Evidence\n\n**File:** `src/app/api/settings/database/route.js`\n```javascript\nexport async function GET() {\n  const payload = await exportDb();\n  return NextResponse.json(payload);\n}\n\nexport async function POST(request) {\n  const payload = await request.json();\n  await importDb(payload);\n  // ...\n}\n```\n\n**File:** `src/lib/db/index.js` (lines 96-163)\n```javascript\nexport async function importDb(payload) {\n  db.transaction(() =\u003e {\n    // Wipe all tables\n    db.run(`DELETE FROM settings`);\n    db.run(`DELETE FROM providerConnections`);\n    db.run(`DELETE FROM providerNodes`);\n    db.run(`DELETE FROM proxyPools`);\n    db.run(`DELETE FROM apiKeys`);\n    db.run(`DELETE FROM combos`);\n    db.run(`DELETE FROM kv WHERE scope IN (...)`);\n    // Then insert attacker-controlled data\n    // ...\n  });\n}\n```\n\nThe `exportDb` function at line 80 exposes API key plaintext:\n```javascript\napiKeys: db.all(`SELECT * FROM apiKeys`).map((r) =\u003e ({ \n  id: r.id, key: r.key, name: r.name, ...\n})),\n```\n\n## Steps to Reproduce\n\n1. Authenticate with any valid JWT (e.g., using the default password \"123456\")\n2. Export: `curl -b auth_token=\u003cjwt\u003e http://localhost:20128/api/settings/database`\n3. Observe: Full database dump with all credentials in plaintext\n4. Import malicious data: `curl -X POST -b auth_token=\u003cjwt\u003e -H \"Content-Type: application/json\" -d \u0027\u003cmodified-db\u003e\u0027 http://localhost:20128/api/settings/database`\n5. All settings, passwords, API keys are now replaced with attacker-controlled values\n\n## Impact\n\n- **Confidentiality:** Complete exposure of all stored secrets (API keys, OAuth tokens, OIDC client secrets)\n- **Integrity:** Complete database replacement with attacker-controlled data\n- **Availability:** Database wipe is possible by importing an empty database\n- **Scope Changed:** Importing new settings affects all users and downstream services\n\n## Recommended Fix\n\n1. Require re-authentication for database export/import (not just an existing session)\n2. Mask/redact API keys in export (or require explicit opt-in for key export)\n3. Add confirmation step for import (require current password verification)\n4. Implement database backup before import\n5. Log all export/import operations with audit trail",
  "id": "GHSA-qvfm-67h2-2qfx",
  "modified": "2026-07-06T21:37:49Z",
  "published": "2026-07-06T21:37:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decolua/9router"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55500 (GCVE-0-2026-55500)

FKIE_CVE-2026-55500

GHSA-QVFM-67H2-2QFX

Summary

Description

Evidence

Steps to Reproduce

Impact

Recommended Fix

Tags

Sightings

Nomenclature

Related by attack behaviour