CVE-2026-40306
Host GUID Disclosure in DNN 10.x.x Enables Unauthorized Access
Publication date: 2026-04-17
Last updated on: 2026-04-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dnnsoftware | dotnetnuke | From 10.0.0 (inc) to 10.2.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-330 | The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves all new installations of DNN 10.x.x through 10.2.1 having the same Host GUID, which does not affect upgrades from 9.x.x. Detection would involve checking the Host GUID value in your DNN installation.
Since no specific detection commands or tools are provided in the available information, a general approach would be to inspect the Host GUID in the DNN configuration or database to verify if it matches the known default GUID used in vulnerable versions.
For example, you might query the database for the Host GUID value or check configuration files where this GUID is stored. However, exact commands depend on your environment and database system.
Can you explain this vulnerability to me?
This vulnerability affects DNN (formerly DotNetNuke), an open-source web content management platform in the Microsoft ecosystem. Specifically, all new installations of DNN versions 10.x.x through 10.2.1 share the same Host GUID, which is a unique identifier that should be distinct for each installation. This issue does not affect upgrades from version 9.x.x. The problem is resolved in version 10.2.2.
How can this vulnerability impact me? :
Having the same Host GUID across all new installations of DNN 10.x.x to 10.2.1 can lead to security and operational issues. Since the Host GUID is intended to uniquely identify an installation, sharing the same GUID may allow attackers or unauthorized users to exploit this common identifier to impersonate or interfere with other installations, potentially leading to unauthorized access or other security risks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade any DNN installations from versions 10.x.x up to 10.2.1 to version 10.2.2, which patches the issue.