This vulnerability is a mass assignment flaw in the PATCH /api/settings endpoint of 9Router, which accepts an unrestricted request body and writes the entire payload to persistent settings. An authenticated user can therefore alter security‑critical fields, such as requireLogin and disable authentication, effectively turning off application authentication. The result is that formerly protected routes like /api/keys and /api/providers become exposed to unauthenticated traffic, allowing attackers to read or manipulate sensitive data and functions. The weakness corresponds to CWE‑915, which reflects unsafe handling of user‑supplied data that can lead to privilege escalation.

The vendor is decolua, product 9Router. All releases before version 0.5.4 are affected. Versions 0.5.4 and later contain a fix that implements a whitelist for writable fields in the PATCH /api/settings endpoint.

The CVSS score of 8.7 labels this flaw as high severity, reflecting its significant impact on confidentiality and integrity when an attacker can manipulate authentication controls. The EPSS score of less than 1% suggests that, although the vulnerability exists, the estimated probability of exploitation is low at present; however, it remains an attractive target for attackers who already possess valid credentials. The vulnerability is not listed in the CISA KEV catalog, which means there are currently no confirmed widespread exploitations documented. Attackers would need an authenticated session against the API but do not require elevated privileges to perform the downgrade, making the attack vector relatively straightforward for insiders or compromised users.