Vulnerability Description
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm8
- https://www.vulncheck.com/advisories/network-ai-through-missing-authorization-vi
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm8
FAQ
What is CVE-2026-64622?
CVE-2026-64622 is a vulnerability with a CVSS score of 7.5 (HIGH). Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configure...
How severe is CVE-2026-64622?
CVE-2026-64622 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-64622?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.