MICROSOFT.ASPNETCORE.APP · CVE-2026-114146 · Runtime
FIX → 11.0.0 · 10.0.15 · 9.0.23 · 8.0.34 ✓ verified
ASP.NET Core has an incorrect authorization check that lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact code path or the affected versions.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Microsoft lists ASP.NET Core on .NET 8, 9, 10 and 11 as affected by an elevation of privilege flaw (CVSS 9.0, network, low privileges, user interaction required). Microsoft has not yet published which feature or configuration is involved, so treat any ASP.NET Core app that has signed-in users with different roles as in scope until you have patched. Apps already on the November releases can skip it.
Who cares aspnet-core, dotnet, web-apps
dotnet --list-runtimes and look at Microsoft.AspNetCore.App: exposed if below 8.0.34 (8.x), 9.0.23 (9.x) or 10.0.15 (10.x)Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 11.0.0 · 10.0.15 · 9.0.23 · 8.0.34
Update the .NET runtime / ASP.NET Core to 8.0.34, 9.0.23, 10.0.15 or 11.0.0 (Microsoft's November 10, 2026 servicing release), then rebuild and redeploy; self-contained apps and containers need a new build or image.