{"id":"CVE-2026-109481","kind":"vulnerability","aliases":["CVE-2026-109481"],"related":[],"title":"ASP.NET Core: cross-site request forgery lets an attacker elevate privileges","description":"Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.","summary":"ASP.NET Core has a cross-site request forgery flaw that lets an unauthorized attacker act as a logged-in user over the network. The attacker can use it to elevate privileges, according to the NVD entry.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspnet-core","dotnet","runtime","web-apps"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:17+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","triaged_at":"2026-11-10T19:47:23+00:00","updated_at":"2026-11-10T19:47:23+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T19:47:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ASP.NET Core: cross-site request forgery lets an attacker elevate privileges","impact":"high","summary":"ASP.NET Core has a cross-site request forgery flaw that lets an unauthorized attacker act as a logged-in user over the network. The attacker can use it to elevate privileges, according to the NVD entry.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","web-apps"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker elevates privileges through a victim's authenticated browser session","analyst_note":"Check the NVD entry and Microsoft's ASP.NET Core advisory for affected version ranges, the fixed versions and the exact conditions for exposure.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":4504,"output_tokens":384,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the NVD entry and Microsoft's ASP.NET Core advisory for affected version ranges, the fixed versions and the exact conditions for exposure.","search":"'-109481':15A,18A '-2026':14A,17A 'accord':60B 'act':42B 'allow':74C 'app':26B 'asp.net':1A,27B,72C 'aspnet':20B 'aspnet-cor':19B 'attack':10A,41B,53B,77C 'core':2A,21B,28B,73C 'cross':4A,32B,66C 'cross-sit':3A,31B,65C 'csrf':70C 'cve':13A,16A 'dotnet':22B 'elev':11A,58B,79C 'entri':64B 'flaw':36B 'forgeri':7A,35B,69C 'let':8A,38B 'log':46B 'logged-in':45B 'network':51B,83C 'nvd':63B 'privileg':12A,59B,80C 'request':6A,34B,68C 'runtim':23B 'site':5A,33B,67C 'unauthor':40B,76C 'use':55B 'user':48B 'web':25B 'web-app':24B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnetcore","dotnet","high","runtime","webapps"],"campaign_type":null,"search_a":"'-109481':15A,18A '-2026':14A,17A 'asp.net':1A 'attack':10A 'core':2A 'cross':4A 'cross-sit':3A 'cve':13A,16A 'elev':11A 'forgeri':7A 'let':8A 'privileg':12A 'request':6A 'site':5A","search_b":"'accord':60B 'act':42B 'app':26B 'asp.net':27B 'aspnet':20B 'aspnet-cor':19B 'attack':41B,53B 'core':21B,28B 'cross':32B 'cross-sit':31B 'dotnet':22B 'elev':58B 'entri':64B 'flaw':36B 'forgeri':35B 'let':38B 'log':46B 'logged-in':45B 'network':51B 'nvd':63B 'privileg':59B 'request':34B 'runtim':23B 'site':33B 'unauthor':40B 'use':55B 'user':48B 'web':25B 'web-app':24B","search_c":"'allow':74C 'asp.net':72C 'attack':77C 'core':73C 'cross':66C 'cross-sit':65C 'csrf':70C 'elev':79C 'forgeri':69C 'network':83C 'privileg':80C 'request':68C 'site':67C 'unauthor':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109481","severity":null,"published_at":"2026-11-10T19:18:17+00:00","modified_at":"2026-11-10T19:18:17+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","fetched_at":"2026-11-10T19:24:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}