GitHub Advisoryadvisory · npm

GHSA-xrrh-p7f2-27vm decolua 9router vulnerable to authorization bypass

MEDIUM Published 2026-04-09 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-5842
Ecosystem
npm
Packages
9router
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-285
Reviewed
2026-04-10

Affected packages

• npm 9router: < 0.3.75 → fixed in 0.3.75

Description

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.

Related

Alias · CVE (1)

  • CVE-2026-5842 A security vulnerability has been detected in decolua 9router up to 0.3.47. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References