CVE-2026-112044
Received Received - Intake

Improper Authentication in dotnet eShop Catalog API

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112044
EUVD
EUVD-2026-104053

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dotnet eShop 913acea66708a59595351174cee9b29f37179d29

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112044 is a security flaw in the dotnet eShop application's Catalog API. The vulnerability allows unauthenticated users to perform administrative actions like creating, modifying, or deleting catalog items without proper authentication or authorization. This occurs due to missing authentication and authorization mechanisms in the Catalog API's mutation endpoints.

Detection Guidance

Check if the Catalog API endpoints (CreateItem, UpdateItem v1/v2, DeleteItemById) are accessible without authentication. Inspect the Extensions.cs file for missing AddDefaultAuthentication() calls and Program.cs for missing UseAuthentication() and UseAuthorization() middleware. Verify if the Identity__Url environment variable is set in AppHost configuration.

Impact Analysis

This vulnerability can lead to severe consequences such as financial loss, fraudulent transactions, or denial of service. Attackers could manipulate product prices, create fake items, or delete the entire catalog. The impact is significant as it affects the core functionality of an e-commerce application.

Compliance Impact

The vulnerability allows unauthenticated users to create, modify, or delete catalog items without restrictions, which could lead to unauthorized data manipulation. This may violate GDPR's integrity and confidentiality principles if personal or sensitive data is altered, and HIPAA's integrity and availability requirements if catalog data includes protected health information.

Mitigation Strategies

Add default authentication in Extensions.cs with builder.AddDefaultAuthentication(). Ensure Program.cs includes app.UseAuthentication() and app.UseAuthorization(). Set the Identity__Url environment variable in AppHost. Apply authorization requirements to mutation endpoints using RequireAuthorization(). Review YARP catch-all routes in mobile BFF to enforce authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart