# CVE-2026-64622: Jovancoding Network-AI missing authorization in ApprovalInbox GET routes

Source: https://junglewise.ai/threats/cve-2026-64622-jovancoding-network-ai-missing-authorization-in-approvalinbox-get  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-64622 · Severity: high · CVSS 7.5 · Published 2026-07-20

Network-AI, a tool used for managing automated network actions, contains a security flaw where sensitive approval requests are exposed to unauthorized users. Even if a password is set, an attacker can view pending system commands, file paths, and justifications for high-risk actions. Additionally, a configuration error allows malicious websites to steal this information if an administrator visits them while logged into the tool.

Technologies: [Jovancoding Network-AI](https://junglewise.ai/threats/technologies/network-ai). Vendors: [Jovancoding](https://junglewise.ai/threats/vendors/jovancoding).

## Quick answers

**Is CVE-2026-64622 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64622 being exploited in the wild.

**How severe is CVE-2026-64622?** High severity, with a CVSS score of 7.5, published 20 July 2026.

**Which products and versions are affected?** Jovancoding Network-AI 5.12.2 through 5.13.3.

**Is there a fix for CVE-2026-64622?** A patch was published on 2026-07-20: Version 5.13.4 released to address the incomplete fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64622 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-64622?** Check whether you run Jovancoding Network-AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the ApprovalInbox component of the network-ai npm package. While a previous fix (GHSA-mxjx-28vx-xjjj) implemented authorization for mutating POST requests, it failed to apply the 'checkAuth' logic to GET routes including /approvals/?status=all, /approvals/:id, /approvals/stats, and /approvals/sse. An unauthenticated attacker can access these endpoints to retrieve full ApprovalEntry details, such as shell-command strings and file paths. Furthermore, the application uses a hardcoded 'Access-Control-Allow-Origin: *' header, facilitating cross-origin data exfiltration via a victim's browser. The issue is patched in version 5.13.4.

## Affected products

- Jovancoding Network-AI (npm: network-ai) 5.12.2 through 5.13.3

## Timeline

- 2026-07-05: advisory: Vendor advisory GHSA-m4jg-6w3q-gm86 published
- 2026-07-20: disclosed: CVE-2026-64622 published to NVD
- 2026-07-20: patched: Version 5.13.4 released to address the incomplete fix

## References

- [https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86](https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86)
- [https://www.vulncheck.com/advisories/network-ai-through-missing-authorization-via-approvalinbox](https://www.vulncheck.com/advisories/network-ai-through-missing-authorization-via-approvalinbox)

## Related threats

- [Network-AI A2AServer missing authentication in task operations](https://junglewise.ai/threats/cve-2026-120314-network-ai-from-5-14-0-before-5-15-5-contains-a-missing)
- [Network-AI path traversal in InputSanitizer.sanitizePath](https://junglewise.ai/threats/cve-2026-120313-network-ai-before-5-15-5-contains-a-path-traversal-vulnerability)
- [Network-AI AgentVCR path traversal in cassette name](https://junglewise.ai/threats/cve-2026-120312-network-ai-from-5-13-4-before-5-15-5-contains-a-path-traversal)
- [Network-AI FileJobStore path traversal in job ID handling](https://junglewise.ai/threats/cve-2026-120311-network-ai-from-5-13-4-before-5-15-5-contains-a-path-traversal)
- [Network-AI security control bypass in ClaudeHookBridge](https://junglewise.ai/threats/cve-2026-109331-network-ai-from-5-14-0-before-5-15-2-contains-a-security-control)