Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-64622Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

High 7.5

In plain English

A high-severity missing authorization in Network-AI from Jovancoding. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.

Affected products (as reported)

Vendor	Product	Versions
Jovancoding	Network-AI	5.12.2 – through 5.13.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-m4jg-6w3q-gm86) vendor-advisory
VulnCheck Advisory: Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox third-party-advisory