CVE-2026-112044

HighCVSS 7.3

Published: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Summary

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the AddApplicationServices function in src/Catalog.API/Extensions/Extensions.cs of the Catalog API component. The manipulation leads to improper authentication, and the attack can be initiated remotely. The project was informed but has not responded.

Risk Assessment

A remote attacker may exploit improper authentication in the Catalog API, potentially leading to unauthorized access to functions or data.

Recommendation

Monitor the report and apply a fix once available; meanwhile, limit Catalog API exposure and verify authentication mechanisms.

Other vulnerabilities in dotnet eShop

CVE-2026-105444Medium
A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

Original NVD description (English source)

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS