HIGH GitHub
CVE-2026-56679
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
### Summary
The `PATCH /api/settings` endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably `requireLogin`. Setting `requireLogin: false` disables authentication for the whole application, exposing all protected routes (e.g. `/api/keys`, `/api/providers`) to unauthenticated access.
### Details
Root cause is unfiltered mass assignment (CWE-915):
- `src/ap
Affected Products
- npm/9router <= 0.5.2
References
- https://github.com/advisories/GHSA-vmjq-hvgq-2wv4
- https://github.com/decolua/9router/security/advisories/GHSA-vmjq-hvgq-2wv4
- https://nvd.nist.gov/vuln/detail/CVE-2026-56679
- https://github.com/advisories/GHSA-vmjq-hvgq-2wv4
This high severity vulnerability was published on 2026-09-23 via GitHub. Affected: npm/9router <= 0.5.2.
vulnfeed aggregates 12908 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.