CVE-2026-62328
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jul 13, 2026
CISA due date
—
The record
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Biometric… CWE-359
- CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could… CWE-359
- CVE-2026-74966 Information disclosure in the Form Autofill component. CWE-359
- CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-359
- CVE-2026-48048 XWiki Platform is a generic wiki platform. CWE-359
- CVE-2026-24078 Information Disclosure when IPSec negotiation fails or is not established properly during… CWE-359
- CVE-2026-55496 Cloudreve is a self-hosted file management and sharing system. CWE-359
- CVE-2026-50657 Exposure of private personal information to an unauthorized actor in Microsoft Defender… CWE-359