CVE-2026-105444

MediumCVSS 6.3

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

Risk Assessment

An attacker could manipulate order identifiers, potentially leading to unauthorized access to other users' order data.

Recommendation

Since the project has not responded, implement your own mitigation measures such as input validation and sanitization, and access control to resources.

Other vulnerabilities in dotnet eShop

CVE-2026-112044High
A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the AddApplicationServices function in src/Catalog.API/Extensions/Extensions.cs of the Catalog API component. The manipulation leads to improper authentication, and the attack can be initiated remotely. The project was informed but has not responded.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS