Summary
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here, notably requireLogin. Setting requireLogin: false disables authentication for the whole application, exposing all protected routes (e.g. /api/keys, /api/providers) to unauthenticated access.
Details
Root cause is unfiltered mass assignment (CWE-915):
src/app/api/settings/route.js(PATCH handler) parses the body and passes it toupdateSettings(body), with special handling only fornewPasswordandoidcClientSecret. All other fields pass through.src/lib/db/repos/settingsRepo.js,updateSettingsdoesnext = { ...current, ...updates }, so any key in the body overwrites stored settings, includingrequireLogin,tunnelDashboardAccess,authMode.src/dashboardGuard.js,isAuthenticatedreturnstruewheneversettings.requireLogin === false, bypassing auth on all protected routes.
This is distinct from CVE-2026-5842 (CWE-285, pre-auth bypass on /api, patched in 0.3.75). This finding requires a valid authenticated session and abuses input handling, not missing authentication.
PoC
Instance on localhost:20128, default password 123456.
- Authenticate, capture session:
POST /api/auth/loginbody{"password":"123456"}→200 {"success":true} - Mass-assign with the authenticated session:
PATCH /api/settingsbody{"requireLogin":false}→200, response confirms"requireLogin":false - Verify bypass with NO session/credentials:
GET /api/keys→200, returns full API key list unauthenticated - Cleanup (authenticated):
PATCH /api/settingsbody{"requireLogin":true}→GET /api/keysreturns401again
Impact
Post-authentication mass assignment. Any authenticated user (including one using the default password) can disable authentication globally, then read all stored API keys and provider connection data without credentials, and toggle tunnel/dashboard exposure. Escalates to remote full compromise when chained with the default password 123456 on an instance exposed via tunnel (tunnelDashboardAccess defaults to true).
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Whitelist user-configurable fields in the PATCH handler; move security-critical fields (requireLogin, tunnelDashboardAccess, authMode) to a dedicated endpoint requiring re-authentication (current-password re-entry), mirroring the existing DB export/import re-auth flow.
Frequently Asked Questions
- What is CVE-2026-56679? CVE-2026-56679 is a high-severity security vulnerability in 9router (npm), affecting versions <= 0.5.2. It is fixed in 0.5.4.
- Which versions of 9router are affected by CVE-2026-56679? 9router (npm) versions <= 0.5.2 is affected.
- Is there a fix for CVE-2026-56679? Yes. CVE-2026-56679 is fixed in 0.5.4. Upgrade to this version or later.
- Is CVE-2026-56679 exploitable, and should I be worried? Whether CVE-2026-56679 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-56679 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-56679? Upgrade
9routerto 0.5.4 or later.