CVE-2026-64622
Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.
| CWE | CWE-862 |
| Vendor | jovancoding |
| Product | network-ai |
| Published | Jul 20, 2026 |
| Last Updated | Jul 20, 2026 |
Get instant alerts for jovancoding network-ai
Be the first to know when new high vulnerabilities affecting jovancoding network-ai are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N