CVE-2026-10269

decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization

State: Published
Severity: 5.3 Medium
Published: Jun 1, 2026
Updated: Jun 1, 2026
Reserved: May 31, 2026

Description

A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
9routerdecolua	0.1Affected 0.2Affected 0.3Affected 0.4.0Affected 0.4.1Not affected

References

VDB-367548 | decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorizationvdb-entrytechnical-description
VDB-367548 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-10269 | CVE Analysis and Reportthird-party-advisory
Submit #825188 | decolua 9router >= 0.2.72, < 0.4.1 Origin Validation Errorthird-party-advisory
https://github.com/decolua/9router/issues/742issue-tracking
https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95capatch
https://github.com/decolua/9router/releases/tag/v0.4.1patch
https://github.com/decolua/9router/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.