CVE-2026-10269

MediumCVSS 6.3

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A security vulnerability has been detected in decolua 9router up to version 0.4.0. The function isAuthenticated in src/dashboardGuard.js has improper authorization due to manipulation of the Host argument. The attack can be carried out remotely.

Risk Assessment

The risk is remote bypass of authorization mechanisms, potentially leading to unauthorized access to protected resources.

Recommendation

It is recommended to upgrade decolua 9router to version 0.4.1 or later.

Other vulnerabilities in decolua 9router

CVE-2026-103530High
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the fetch function in src/shared/utils/ssrfGuard.js of the Search Endpoint component. Manipulation of the provider_options.baseUrl argument results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action.

Original NVD description (English source)

A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS