PT-2026-31584 · Decolua · 9Router

Cyberthoth · Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-5842

NVD

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

Exploit

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-5842

Affected Products

9Router

References · 9

• 🔥 https://github.com/deepcat1337/Free_Api_Exploit/tree/main · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5842 · Security Note
• https://github.com/decolua/9router/releases/tag/v0.3.75 · Patch
• https://github.com/decolua/9router/issues/431 · Note
• https://vuldb.com/vuln/356298 · Note
• https://github.com/decolua/9router · Note
• https://vuldb.com/submit/790003 · Note
• https://github.com/decolua/9router/issues/431#issuecomment-4140163867 · Note
• https://vuldb.com/vuln/356298/cti · Note