Network‑AI includes an HTTP server called ApprovalInbox that exposes a human‑in‑the‑loop approval gate. The server implements no authentication and allows all origins by sending Access‑Control‑Allow‑Origin: *, including the mutating endpoints POST /:id/approve and POST /:id/deny. As a result, any client that can reach the inbox port—whether a local process, a container facing the host, a remote connection to a non‑loopback binding, or a browser tricked via CORS—can list pending approvals and approve or deny them. This allows an attacker to bypass the intended approval procedure and trigger high‑risk operations such as queued shell commands without manual consent.

Jovancoding’s Network‑AI product is affected in all releases from 5.0.0 up to and including 5.12.1. The vulnerability is fixed in version 5.12.2 where the ApprovalInbox server requires a bearer token on POST requests and defaults to binding on 127.0.0.1; operators that expose the inbox on a network must configure a secret token.

The CVSS score of 5.9 classifies the flaw as moderate severity. The EPSS score is listed as <1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires network or local access to the inbox HTTP server. With the server exposed on a non‑loopback address, any remote client can reach it; otherwise, a local or container process can exploit the default localhost binding or leverage an SSRF. Successful exploitation permits enumeration of pending approvals and manipulation of their state, effectively allowing the queued high‑risk operation to run without authorization.