{"id":"CVE-2026-114146","kind":"vulnerability","aliases":["CVE-2026-114146"],"related":[],"title":"ASP.NET Core: authorization flaw lets a signed-in user gain higher privileges","description":"Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.","summary":"ASP.NET Core has an incorrect authorization check that lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact code path or the affected versions.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft.AspNetCore.App","fixed":["8.0.34","9.0.23","10.0.15","11.0.0"],"affected":"8.x < 8.0.34; 9.x < 9.0.23; 10.x < 10.0.15; 11.x < 11.0.0","ecosystem":"nuget"}],"ecosystems":[],"tags":["aspnet-core","dotnet","runtime","web-apps"],"not_affected_if":[],"how_to_check":"Run 'dotnet --list-runtimes' and look at Microsoft.AspNetCore.App: exposed if below 8.0.34 (8.x), 9.0.23 (9.x) or 10.0.15 (10.x). Also check container base images and self-contained deployments. Microsoft has not yet published the affected feature or configuration, so whether a given app is reachable is unknown.","fix":"Update the .NET runtime / ASP.NET Core to 8.0.34, 9.0.23, 10.0.15 or 11.0.0 (Microsoft's November 10, 2026 servicing release), then rebuild and redeploy; self-contained apps and containers need a new build or image.","status":"open","published_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","triaged_at":"2026-11-10T19:25:51+00:00","updated_at":"2026-11-10T19:35:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T19:25:51Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"ASP.NET Core: authorization flaw lets a signed-in user gain higher privileges","impact":"high","summary":"ASP.NET Core has an incorrect authorization check that lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact code path or the affected versions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","web-apps"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker gains elevated privileges over the network","analyst_note":"Check the NVD entry and Microsoft's security update guide for CVE-2026-114146 for affected ASP.NET Core versions, fixed releases and any configuration prerequisites.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running ASP.NET Core web applications or services that rely on its authorization for access control are the ones to look at. The sources do not say which versions or configurations are affected, so whether a given app is exposed is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000671,"input_tokens":4489,"output_tokens":445,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for CVE-2026-114146 for affected ASP.NET Core versions, fixed releases and any configuration prerequisites.","search":"'-114146':16A,19A '-2026':15A,18A 'account':44B 'affect':62B 'allow':69C 'alreadi':41B 'app':28B 'asp.net':1A,29B,67C 'aspnet':22B 'aspnet-cor':21B 'attack':39B,72C 'author':3A,34B,65C,71C 'check':35B 'code':58B 'core':2A,23B,30B,68C 'cve':14A,17A 'describ':55B 'dotnet':24B 'elev':74C 'exact':57B 'flaw':4A 'gain':11A 'higher':12A 'incorrect':33B,64C 'let':5A,37B 'microsoft.aspnetcore.app':20A 'network':50B,78C 'path':59B 'privileg':13A,47B,75C 'rais':45B 'runtim':25B 'sign':8A 'signed-in':7A 'sourc':52B 'user':10A 'version':63B 'web':27B 'web-app':26B","nicknames":[],"mitigations":[],"who_affected":"Microsoft lists ASP.NET Core on .NET 8, 9, 10 and 11 as affected by an elevation of privilege flaw (CVSS 9.0, network, low privileges, user interaction required). Microsoft has not yet published which feature or configuration is involved, so treat any ASP.NET Core app that has signed-in users with different roles as in scope until you have patched. Apps already on the November releases can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T19:35:35Z","by":"analyst","doc":"https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/","run_id":2526}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["microsoftaspnetcoreapp"],"ptokens":["app","aspnetcore","microsoft"],"labels":["aspnetcore","critical","dotnet","runtime","webapps"],"campaign_type":null,"search_a":"'-114146':16A,19A '-2026':15A,18A 'asp.net':1A 'author':3A 'core':2A 'cve':14A,17A 'flaw':4A 'gain':11A 'higher':12A 'let':5A 'microsoft.aspnetcore.app':20A 'privileg':13A 'sign':8A 'signed-in':7A 'user':10A","search_b":"'account':44B 'affect':62B 'alreadi':41B 'app':28B 'asp.net':29B 'aspnet':22B 'aspnet-cor':21B 'attack':39B 'author':34B 'check':35B 'code':58B 'core':23B,30B 'describ':55B 'dotnet':24B 'exact':57B 'incorrect':33B 'let':37B 'network':50B 'path':59B 'privileg':47B 'rais':45B 'runtim':25B 'sourc':52B 'version':63B 'web':27B 'web-app':26B","search_c":"'allow':69C 'asp.net':67C 'attack':72C 'author':65C,71C 'core':68C 'elev':74C 'incorrect':64C 'network':78C 'privileg':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114146","severity":null,"published_at":"2026-11-10T19:19:07+00:00","modified_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","fetched_at":"2026-11-10T19:24:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114146:2526","url":"https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/","severity":null,"published_at":"2026-11-10T19:35:35+00:00","modified_at":"2026-11-10T19:35:35+00:00","first_seen_at":"2026-11-10T19:35:35+00:00","fetched_at":"2026-11-10T19:35:35+00:00","note":"Microsoft's Nov 10 2026 .NET servicing post lists this CVE as fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0. No per-CVE advisory with root cause found yet; MSRC and NVD pages returned nothing. Revisit when the advisory is published.","cites":["https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/"]}],"documents":[{"id":117591,"url":"https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/","title":".NET and .NET Framework November 2026 servicing updates","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}