CVE-2026-112044

7.3High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-287

Impact

Remote, unauthenticated attackers can bypass authentication on the Catalog API to read, modify, or disrupt application data. They only need network access to the API endpoint.

Root cause

Improper authentication handling in the AddApplicationServices configuration inside src/Catalog.API/Extensions/Extensions.cs.

Affected systems

dotnet eShop up to commit 913acea66708a59595351174cee9b29f37179d29.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

No fixed release or patch exists yet; restrict network access to the Catalog API or enforce upstream authentication at a reverse proxy or API gateway until an official fix is merged.

shell

$ git log -1 --format="%H"

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112044