---
id: "CVE-2026-114146"
page: "https://infrastack.ai/live/CVE-2026-114146"
kind: "vulnerability"
aliases: ["CVE-2026-114146"]
title: "ASP.NET Core: authorization flaw lets a signed-in user gain higher privileges"
severity: "critical"
cvss: 9.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Microsoft.AspNetCore.App", "fixed": ["8.0.34", "9.0.23", "10.0.15", "11.0.0"], "affected": "8.x < 8.0.34; 9.x < 9.0.23; 10.x < 10.0.15; 11.x < 11.0.0", "ecosystem": "nuget"}]
ecosystems: []
tags: ["aspnet-core", "dotnet", "runtime", "web-apps"]
not_affected_if: []
published_at: "2026-11-10T19:19:07+00:00"
first_seen_at: "2026-11-10T19:24:43+00:00"
updated_at: "2026-11-10T19:35:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114146", "first_seen_at": "2026-11-10T19:24:43+00:00"}, {"source": "analyst", "url": "https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/", "first_seen_at": "2026-11-10T19:35:35+00:00", "cites": ["https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/"]}]
exploit_sources: []
---

# ASP.NET Core: authorization flaw lets a signed-in user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-114146 (this .md is for agents)

ASP.NET Core has an incorrect authorization check that lets an attacker who already has an account raise their privileges over the network. The sources do not describe the exact code path or the affected versions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:Microsoft.AspNetCore.App affected 8.x < 8.0.34; 9.x < 9.0.23; 10.x < 10.0.15; 11.x < 11.0.0 fixed 8.0.34, 9.0.23, 10.0.15, 11.0.0

## How to check

Run 'dotnet --list-runtimes' and look at Microsoft.AspNetCore.App: exposed if below 8.0.34 (8.x), 9.0.23 (9.x) or 10.0.15 (10.x). Also check container base images and self-contained deployments. Microsoft has not yet published the affected feature or configuration, so whether a given app is reachable is unknown.

## Fix

Update the .NET runtime / ASP.NET Core to 8.0.34, 9.0.23, 10.0.15 or 11.0.0 (Microsoft's November 10, 2026 servicing release), then rebuild and redeploy; self-contained apps and containers need a new build or image.

## Timeline

- 2026-11-10T19:24:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114146
- 2026-11-10T19:35:35+00:00 analyst https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/ — Microsoft's Nov 10 2026 .NET servicing post lists this CVE as fixed in 8.0.34, 9.0.23, 10.0.15, 11.0.0. No per-CVE advisory with root cause found yet; MSRC and NVD pages returned nothing. Revisit when the advisory is published.

## Documents

- [advisory] .NET and .NET Framework November 2026 servicing updates https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/

## From the sources

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_