Log in Start free

Vulnerability · Published Apr 9, 2026 · Assigned by VulDB

CVE-2026-5842decolua 9router Administrative API Endpoint api authorization

High 7.3

In plain English

A high-severity authorization bypass via user-controlled key in 9router from decolua. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.4%top 64.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm9router0.3.75GHSA-xrrh-p7f2-27vm

Affected products (as reported)

VendorProductVersions
decolua 9router 0.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.7

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References