Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Network-AI 5.12.2-5.13.3: Unauthenticated Access to Approval Details

CVE-2026-64622 · published 2 months ago
Summary

Network-AI versions 5.12.2 through 5.13.3 allow anyone to access sensitive approval request information without a password. This is a security risk because it could allow unauthorized people to see confidential data. To fix this, update to a newer version of Network-AI that includes the necessary security fix.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
jovancoding network-ai < *
<= 5.13.3
Original advisory text
Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.
References
Severity
9.3 Critical
CVSS 3.1: 7.5 (NVD)
CVSS 4.0: 9.3 (NVD)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-862Missing Authorization
Timeline
Published20 Jul 2026
Updated25 Sep 2026
First seen20 Jul 2026
Sources
CVE-2026-64622 · NVD
CVE-2026-64622 · MITRE
CVE-2026-64622 · OSV
GHSA-m4jg-6w3q-gm86 · GHSA
Track software like this
Free during beta