Sec-Reex

**Name of the Vulnerable Software and Affected Versions** Network-AI versions 5.12.2 through 5.13.3 **Description** The software fails to apply the configured authorization check `checkAuth/secret` to the ApprovalInbox GET read routes. This allows unauthenticated actors to access sensitive approval request details, including action/target shell-command strings, file paths, justifications, and risk levels. The affected API endpoints are '/approvals/?status=all', '/approvals/:id', '/approvals/stats', and '/approvals/sse'. Additionally, responses include a hardcoded Access-Control-Allow-Origin: * header, which enables cross-origin disclosure from any website visited by the operator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.