CVE-2026-105444CWE-99

CVE-2026-105444

Medium · published October 6, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-99 · Improper Control of Resource Identifiers ('Resource Injection')
Published
2026-10-06T01:16Z
References (6)
https://github.com/dotnet/eShop/ · [email protected]https://github.com/dotnet/eShop/issues/996 · [email protected]https://vuldb.com/cve/CVE-2026-105444 · [email protected]https://vuldb.com/submit/984283 · [email protected]https://vuldb.com/vuln/413608 · [email protected]https://vuldb.com/vuln/413608/cti · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 05 OCT 21:00Z
    dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection
    cvelistv5