PT-2026-61582 · Jovancoding · Network-Ai

Sec-Reex · CVE-2026-64622 · Published 2026-07-20 · Updated 2026-07-20

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-64622

Affected Products

Network-Ai

References · 3

• 🔥 https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-64622 · Security Note
• https://vulncheck.com/advisories/network-ai-through-missing-authorization-via-approvalinbox · Note