{"action":"Upgrade 9router to 0.5.4 or later.","affected":[{"fixed":"0.5.4","introduced":"0"}],"component":"9router","cve_ids":["CVE-2026-56679"],"ecosystem":"npm","epss":0.00401,"exploited":false,"fixed_versions":["0.5.4"],"ghsa_id":"GHSA-vmjq-hvgq-2wv4","id":"tcs_01M5KGCC37ZPYMN6Y23EDM5WBD","modified_at":"2026-09-23T18:27:57.574622900Z","published_at":"2026-09-23T18:12:33Z","references":["https://osv.dev/vulnerability/GHSA-vmjq-hvgq-2wv4","https://github.com/decolua/9router/security/advisories/GHSA-vmjq-hvgq-2wv4","https://nvd.nist.gov/vuln/detail/CVE-2026-56679","https://github.com/decolua/9router"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-vmjq-hvgq-2wv4","url":"https://osv.dev/vulnerability/GHSA-vmjq-hvgq-2wv4"}],"summary":"9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade"}