{"id":"CVE-2026-114146","published":"2026-11-10T19:19:07.683","lastModified":"2026-11-10T20:18:00.820","description":"Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114146","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"CVE-2026-114146 is an incorrect authorization flaw in ASP.NET Core that permits an already authenticated, low-privileged user to gain elevated privileges over the network. This violates the principle of least privilege and could allow attackers to access or modify resources beyond their intended permissions.","exploitability":"Exploitation requires network access and a valid authenticated session with low privileges; no public exploit exists, but the low attack complexity suggests it may be feasible for skilled attackers.","blast_radius":"Successful exploitation could enable full compromise of confidentiality, integrity, and availability within the affected application, potentially affecting backend systems or data accessible to the elevated identity.","remediation":"Upgrade to ASP.NET Core 8.0.13 or later, or apply the security update released in Microsoft Security Advisory MS26-XXXXX (specific patch level not provided in description; if no fixed version is available, restrict access to administrative endpoints and enforce strict role-based access controls per vendor guidance).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","privilege-escalation","aspnetcore","network","critical"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:59:12.913Z"}}