Missing authorization on ApprovalInbox GET routes in Network-AI (CVE-2026-64622)

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, allowing unauthenticated actors to retrieve full ApprovalEntry content-including action/target shell-command strings, file paths, justifications, and risk levels-even when a secret is configured. The affected routes (GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse) also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj. Affected versions: - >= 5.12.2, <= 5.13.3 We recommend updating to: 5.13.4. CVSS 9.3 · our assessment: act_now Reference: https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86 Details: https://vuln.today/cve/CVE-2026-64622