{"id":"CVE-2026-112044","kind":"vulnerability","aliases":["CVE-2026-112044"],"related":[],"title":"dotnet eShop: Catalog API flaw allows improper authentication remotely","description":"A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The Catalog API in the dotnet eShop sample application has an improper authentication flaw in its AddApplicationServices setup code. A remote attacker may be able to reach catalog functions without valid authentication.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asp.net-core","dotnet","package","self-hosted"],"not_affected_if":["not-using-eshop"],"how_to_check":"- Check whether the deployed eShop version matches or predates commit `913acea66708a59595351174cee9b29f37179d29`\n- Review `src/Catalog.API/Extensions/Extensions.cs` in your fork for changes to `AddApplicationServices`\n- unknown for other checks","fix":"- unknown: the sources report no patched version and the project had not responded at the time of the report\n- Restrict network access to the Catalog API until an upstream fix is confirmed","status":"open","published_at":"2026-10-19T03:16:59+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:26+00:00","updated_at":"2026-10-25T03:23:26+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:23:26Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report no patched version and the project had not responded at the time of the report\n- Restrict network access to the Catalog API until an upstream fix is confirmed","reach":"internet","title":"dotnet eShop: Catalog API flaw allows improper authentication remotely","impact":"medium","summary":"The Catalog API in the dotnet eShop sample application has an improper authentication flaw in its AddApplicationServices setup code. A remote attacker may be able to reach catalog functions without valid authentication.","category":"package","nicknames":[],"who_cares":["dotnet","asp.net-core","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthenticated remote access to Catalog API functions","analyst_note":"Check the NVD entry and the upstream dotnet eShop issue for the exact auth bypass, affected configuration and any fix commit.","how_to_check":"- Check whether the deployed eShop version matches or predates commit `913acea66708a59595351174cee9b29f37179d29`\n- Review `src/Catalog.API/Extensions/Extensions.cs` in your fork for changes to `AddApplicationServices`\n- unknown for other checks","needs_analyst":true,"not_affected_if":["not-using-eshop"],"who_is_affected":"Teams running or forking the dotnet eShop reference application with the Catalog API exposed to a network. The sources do not say which deployment settings make the flaw reachable, so exposure depends on whether the Catalog API is reachable from outside. Teams that do not run eShop or its Catalog API can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3361,"output_tokens":590,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112044':12A,15A '-2026':11A,14A '913acea66708a59595351174cee9b29f37179d29':66C 'abl':47B 'addapplicationservic':39B,73C 'affect':68C 'allow':6A 'api':4A,25B,82C 'applic':31B 'asp.net':16B 'attack':44B,90C 'authent':8A,35B,54B,88C 'catalog':3A,24B,50B,81C 'code':41B 'compon':80C 'core':17B 'cve':10A,13A 'detect':60C 'dotnet':1A,18B,28B,62C 'earli':102C 'element':69C 'eshop':2A,29B,63C 'file':76C 'flaw':5A,36B 'function':51B,72C 'host':22B 'improp':7A,34B,87C 'inform':98C 'initi':93C 'issu':105C 'lead':85C 'manipul':84C 'may':45B 'packag':19B 'problem':101C 'project':96C 'reach':49B 'remot':9A,43B,94C 'report':106C 'respond':110C 'sampl':30B 'secur':56C 'self':21B 'self-host':20B 'setup':40B 'src/catalog.api/extensions/extensions.cs':77C 'valid':53B 'vulner':57C 'without':52B 'yet':111C","nicknames":[],"mitigations":[],"who_affected":"Teams running or forking the dotnet eShop reference application with the Catalog API exposed to a network. The sources do not say which deployment settings make the flaw reachable, so exposure depends on whether the Catalog API is reachable from outside. Teams that do not run eShop or its Catalog API can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T03:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112044","severity":null,"published_at":"2026-10-19T03:16:59+00:00","modified_at":"2026-10-19T17:17:09+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}