CVE-2026-56679: 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

Published Jul 15, 2026
·
Updated

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.

Affected Software

1 affected component
9router 9router<0.5.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade 9Router to a version that resolves this vulnerability.

    Fixed in 0.5.4

Event History

Jul 15, 2026
CVE Published
via MITRE·08:50 PM
Data Sourced
via MITRE·08:50 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2026-56679?

CVE-2026-56679 has a high severity rating of 8.7.

2

How do I fix CVE-2026-56679?

To fix CVE-2026-56679, update to version 0.5.4 or later of 9Router.

3

What does CVE-2026-56679 exploit?

CVE-2026-56679 exploits a mass assignment vulnerability in the PATCH /api/settings endpoint.

4

What impact does CVE-2026-56679 have?

CVE-2026-56679 allows authenticated users to downgrade authorization and alter critical security settings.

5

Is CVE-2026-56679 present in all versions of 9Router?

Yes, CVE-2026-56679 affects all versions of 9Router prior to version 0.5.4.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203