CVE-2026-55500: 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

July 6, 2026

The /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. Combined with other vulnerabilities (e.g., default password, tunnel exposure), this enables complete database takeover.

References

github.com/advisories/GHSA-qvfm-67h2-2qfx
github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx
nvd.nist.gov/vuln/detail/CVE-2026-55500

Code Behaviors & Features

Detect and mitigate CVE-2026-55500 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →