CVE-2026-40306
Received Received - Intake
Host GUID Disclosure in DNN 10.x.x Enables Unauthorized Access

Publication date: 2026-04-17

Last updated on: 2026-04-24

Assigner: GitHub, Inc.

Description
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. All new installations of DNN 10.x.x - 10.2.1 have the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-17
Last Modified
2026-04-24
Generated
2026-06-16
AI Q&A
2026-04-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-40306
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
dnnsoftware dotnetnuke From 10.0.0 (inc) to 10.2.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects DNN (formerly DotNetNuke), an open-source web content management platform in the Microsoft ecosystem. Specifically, all new installations of DNN versions 10.x.x through 10.2.1 share the same Host GUID, which is a unique identifier that should be distinct for each installation. This issue does not affect upgrades from version 9.x.x. The problem is resolved in version 10.2.2.

Impact Analysis

Having the same Host GUID across all new installations of DNN 10.x.x to 10.2.1 can lead to security and operational issues. Since the Host GUID is intended to uniquely identify an installation, sharing the same GUID may allow attackers or unauthorized users to exploit this common identifier to impersonate or interfere with other installations, potentially leading to unauthorized access or other security risks.

Mitigation Strategies

To mitigate this vulnerability, upgrade any DNN installations from versions 10.x.x up to 10.2.1 to version 10.2.2, which patches the issue.

Detection Guidance

This vulnerability involves all new installations of DNN 10.x.x through 10.2.1 having the same Host GUID, which does not affect upgrades from 9.x.x. Detection would involve checking the Host GUID value in your DNN installation.

Since no specific detection commands or tools are provided in the available information, a general approach would be to inspect the Host GUID in the DNN configuration or database to verify if it matches the known default GUID used in vulnerable versions.

For example, you might query the database for the Host GUID value or check configuration files where this GUID is stored. However, exact commands depend on your environment and database system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart