CVE-2026-62328 affects decolua's 9Router through version 0.4.41. It is an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Specifically, attackers can enumerate paginated request logs and retrieve complete AI conversation histories, including system prompts, user messages, assistant responses, tool calls, and user email addresses, by querying the request-logs and request-details API routes which lack authentication middleware. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

An attacker can remotely access sensitive user data without authentication, including detailed AI conversation histories and user email addresses. This exposure can lead to privacy violations and potential misuse of sensitive information. The vulnerability does not require any privileges or user interaction and can be exploited over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor vendor communications for updates and consider restricting access to the affected API endpoints until a fix is available.