---
id: "CVE-2026-112044"
kind: "vulnerability"
aliases: ["CVE-2026-112044"]
title: "dotnet eShop: Catalog API flaw allows improper authentication remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["asp.net-core", "dotnet", "package", "self-hosted"]
not_affected_if: ["not-using-eshop"]
published_at: "2026-10-19T03:16:59+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:23:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112044", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# dotnet eShop: Catalog API flaw allows improper authentication remotely

The Catalog API in the dotnet eShop sample application has an improper authentication flaw in its AddApplicationServices setup code. A remote attacker may be able to reach catalog functions without valid authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployed eShop version matches or predates commit `913acea66708a59595351174cee9b29f37179d29`
- Review `src/Catalog.API/Extensions/Extensions.cs` in your fork for changes to `AddApplicationServices`
- unknown for other checks

## Fix

- unknown: the sources report no patched version and the project had not responded at the time of the report
- Restrict network access to the Catalog API until an upstream fix is confirmed

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112044

## From the sources

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_