CVE-2026-62328

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.42

Description An unauthenticated information disclosure issue allows remote attackers to access sensitive user data. By querying the 'request-logs' and 'request-details' API endpoints, which lack authentication middleware, attackers can enumerate paginated request logs and retrieve complete AI conversation histories. This exposed data includes system prompts, user messages, assistant responses, tool calls, and user email addresses.

Recommendations Update 9Router to version 0.4.42 or later. Restrict access to the 'request-logs' and 'request-details' API endpoints until the update is applied.