Unauthenticated Information Disclosure in 9Router

Executive Summary

CVE-2026-62328 is an unauthenticated information disclosure vulnerability in 9Router versions up to and including 0.4.41. The vulnerability allows remote attackers to access sensitive user data without requiring authentication.

Specifically, attackers can send requests to unprotected API endpoints in the application. By querying the request-logs and request-details API routes, which lack proper authentication middleware, attackers can enumerate paginated request logs and retrieve complete AI conversation histories. This includes sensitive information such as system prompts, user messages, assistant responses, tool calls, and user email addresses.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check for unauthenticated access to the affected API endpoints in 9Router versions through 0.4.41. The vulnerable endpoints are '/request-logs' and '/request-details', which lack authentication middleware.

• Use a network scanning tool like curl or a web browser to send HTTP GET requests to the suspected endpoints. For example:
• curl -v http://<target-ip-or-domain>/request-logs
• curl -v http://<target-ip-or-domain>/request-details

If the endpoints return sensitive data (e.g., AI conversation histories, user emails, or system prompts) without requiring authentication, the system is vulnerable.

• Monitor network traffic for unusual access patterns to these endpoints, such as repeated requests to '/request-logs' or '/request-details' from unauthorized sources.
• Check server logs for unauthorized access attempts to these API routes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways:

• Exposure of sensitive data: Attackers can access your AI conversation histories, including system prompts, user messages, and assistant responses. This may reveal confidential or personal information.
• Leakage of personal identifiers: Your email address and other user-specific details stored in the logs can be retrieved by attackers, leading to potential privacy violations.
• Increased risk of targeted attacks: With access to your conversation histories and email addresses, attackers may craft phishing or social engineering attacks tailored to you or your organization.
• Reputation damage: If sensitive or proprietary information is exposed, it could harm your personal or organizational reputation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have significant implications for compliance with various standards and regulations:

• GDPR (General Data Protection Regulation): The exposure of personal data, such as email addresses and conversation histories, may violate GDPR requirements. GDPR mandates the protection of personal data and requires organizations to implement appropriate security measures. A breach of this nature could lead to fines, legal action, or reputational damage.
• HIPAA (Health Insurance Portability and Accountability Act): If the exposed data includes protected health information (PHI), this vulnerability could result in a HIPAA violation. HIPAA requires strict safeguards for PHI, and unauthorized access to such data could lead to severe penalties.
• Other data protection laws: Depending on the jurisdiction, similar data protection laws may apply. For example, if the exposed data includes personally identifiable information (PII), it could violate laws like the California Consumer Privacy Act (CCPA) or other regional regulations.

Organizations using 9Router should assess whether the exposed data falls under any regulatory requirements and take corrective actions to mitigate compliance risks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade 9Router to a version beyond 0.4.41 if a patched version is available. Check the vendor's official channels for updates.
• If upgrading is not immediately possible, restrict access to the vulnerable API endpoints ('/request-logs' and '/request-details') by implementing authentication middleware. Ensure all API routes require valid credentials or tokens.
• Apply network-level protections such as firewalls or web application firewalls (WAFs) to block unauthorized access to these endpoints. Configure rules to allow access only from trusted IP addresses.
• Disable or remove the vulnerable endpoints if they are not essential for operations.
• Monitor and audit access to these endpoints to detect and respond to any unauthorized attempts to exploit the vulnerability.
• Review and sanitize the data exposed by these endpoints to ensure no sensitive information (e.g., user emails, conversation histories) is unnecessarily stored or accessible.

Useful 0 Not Useful 0