CVE-2026-105444

Received Received - Intake

Improper Resource Control in dotnet eShop .NET 8 Ordering API

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: VulDB

Description

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-105444

Affected Vendors & Products

Vendor	Product	Version / Range
dotnet	eShop	.NET 8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-99	The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Attack-Flow Graph

Executive Summary

This vulnerability is in dotnet eShop .NET 8, specifically in the GetOrderAsync function of the OrdersApi.cs file. It allows remote attackers to manipulate the OrderNumber argument, leading to improper control of resource identifiers.

Detection Guidance

The vulnerability involves improper control of resource identifiers in the GetOrderAsync function of the Ordering API. To detect it, inspect the Ordering.API component for the OrdersApi.cs file and check for improper handling of the OrderNumber argument. Look for unvalidated or manipulated input in API endpoints.

Impact Analysis

An attacker could exploit this to access or modify order data improperly. Since the attack is remote, it may affect confidentiality, integrity, and availability of order-related resources if exploited.

Compliance Impact

The vulnerability allows manipulation of resource identifiers via the OrderNumber argument in the GetOrderAsync function, which could lead to unauthorized access or data leaks. This may impact compliance with GDPR (data protection) and HIPAA (health data privacy) by exposing sensitive order information if exploited.

Mitigation Strategies

Since the vulnerability involves improper control of resource identifiers in the Ordering API's GetOrderAsync function, immediately review and restrict access to the Orders API endpoint. Validate and sanitize all OrderNumber inputs to prevent manipulation. Consider disabling the affected API if not essential until a patch is available.

Hi! I’m here to help you understand CVE-2026-105444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70