The /api/settings/database endpoint in 9router is protected only by a middleware that validates a JWT or CLI token, which is insufficient. The GET method exports the entire database including plaintext API keys, OAuth tokens, and client secrets. The POST method accepts arbitrary JSON to fully overwrite the database in a transaction, allowing an attacker to set new passwords and credentials. This enables complete credential theft and database takeover. The vulnerability affects all versions up to 0.4.71. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

An attacker with a valid JWT or CLI token can export the entire database including all sensitive credentials in plaintext, leading to full credential disclosure. They can also import arbitrary data to completely overwrite the database, replacing all passwords and settings, resulting in total database takeover. This compromises confidentiality, integrity, and availability of the system and affects all users and downstream services relying on the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Recommended mitigations include requiring re-authentication for database export and import beyond existing session tokens, masking or redacting API keys in exports, adding a confirmation step requiring current password verification before import, implementing database backups before import operations, and logging all export/import actions for audit purposes. Until a fix is available, restrict access to the endpoint and avoid using default or weak passwords.