{"id":"CVE-2026-118740","kind":"vulnerability","aliases":["CVE-2026-118740"],"related":[],"title":"Aspire: missing authorization lets unauthenticated network attackers bypass a security feature","description":"Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.","summary":"Aspire has a missing authorization check that lets an unauthorized attacker bypass a security feature over the network. The sources do not say which security feature or what an attacker can do after bypassing it.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Aspire","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Aspire Dashboard","fixed":[],"affected":">= 13.6.1, <= 13.6.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aspire","aspire-dashboard","dotnet","network","other"],"not_affected_if":[],"how_to_check":"Run 'aspire --version', or check your Aspire.AppHost.Sdk and Aspire.Dashboard.Sdk package versions. If any is 13.6.1 to 13.6.5 and the dashboard is reachable from a network other than localhost, treat it as exposed. The range comes from a mirror, not the vendor; confirm it against the MSRC or GitHub advisory.","fix":null,"status":"open","published_at":"2026-11-10T19:19:50+00:00","first_seen_at":"2026-11-10T19:24:55+00:00","triaged_at":"2026-11-10T19:25:46+00:00","updated_at":"2026-11-10T19:33:37+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:25:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aspire: missing authorization lets unauthenticated network attackers bypass a security feature","impact":"medium","summary":"Aspire has a missing authorization check that lets an unauthorized attacker bypass a security feature over the network. The sources do not say which security feature or what an attacker can do after bypassing it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["aspire","dotnet"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the affected Aspire versions, the bypassed security feature and the fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-118740 and the vendor advisory.","how_to_check":"unknown","plain_action":"","product_name":"Aspire","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000639,"input_tokens":4483,"output_tokens":382,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected Aspire versions, the bypassed security feature and the fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-118740 and the vendor advisory.","search":"'-118740':14A,17A '-2026':13A,16A 'allow':65C 'aspir':1A,21B,23B,27B,64C 'aspire':18A,19A 'aspire-dashboard':22B 'attack':7A,37B,56B,68C 'author':3A,31B,62C 'bypass':8A,38B,60B,70C 'check':32B 'cve':12A,15A 'dashboard':20A,24B 'dotnet':25B 'featur':11A,41B,52B,73C 'let':4A,34B 'miss':2A,30B,61C 'network':6A,26B,44B,76C 'say':49B 'secur':10A,40B,51B,72C 'sourc':46B 'unauthent':5A 'unauthor':36B,67C","nicknames":[],"mitigations":[],"who_affected":"Per a third-party mirror of the CVE record (not Microsoft's own page), the affected products are the Aspire Dashboard and the Aspire.Dashboard.Sdk.linux-x64 package, versions 13.6.1 to 13.6.5. Teams that run the Aspire Dashboard (standalone or through an AppHost) on a network others can reach should look at this first. The record does not name the bypassed security feature. Teams that never run the dashboard, or that use only versions before 13.6.1, are probably not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["aspire","aspiredashboard","dashboard"],"ptokens":["aspire","dashboard"],"labels":["aspire","aspiredashboard","critical","dotnet","network","other","vendor"],"campaign_type":null,"search_a":"'-118740':14A,17A '-2026':13A,16A 'aspir':1A 'aspire':18A,19A 'attack':7A 'author':3A 'bypass':8A 'cve':12A,15A 'dashboard':20A 'featur':11A 'let':4A 'miss':2A 'network':6A 'secur':10A 'unauthent':5A","search_b":"'aspir':21B,23B,27B 'aspire-dashboard':22B 'attack':37B,56B 'author':31B 'bypass':38B,60B 'check':32B 'dashboard':24B 'dotnet':25B 'featur':41B,52B 'let':34B 'miss':30B 'network':26B,44B 'say':49B 'secur':40B,51B 'sourc':46B 'unauthor':36B","search_c":"'allow':65C 'aspir':64C 'attack':68C 'author':62C 'bypass':70C 'featur':73C 'miss':61C 'network':76C 'secur':72C 'unauthor':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118740","severity":null,"published_at":"2026-11-10T19:19:50+00:00","modified_at":"2026-11-10T19:19:50+00:00","first_seen_at":"2026-11-10T19:24:55+00:00","fetched_at":"2026-11-10T19:24:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118740:2520","url":"https://cve.imfht.com/detail/CVE-2026-118740","severity":null,"published_at":"2026-11-10T19:33:37+00:00","modified_at":"2026-11-10T19:33:37+00:00","first_seen_at":"2026-11-10T19:33:37+00:00","fetched_at":"2026-11-10T19:33:37+00:00","note":"NVD and MSRC pages returned nothing, and no Microsoft or GitHub advisory was found. The only source is a mirror of the CVE List V5 record (assigned by Microsoft, CVSS 9.1, AV:N/PR:N, CWE missing authorization). It gives 13.6.1 to 13.6.5 as affected, with no fixed version and no named feature. The latest GitHub release seen was 13.6.4, so 13.6.5 could not be confirmed. Nothing is marked verified. Revisit when the MSRC or GitHub advisory appears.","cites":["https://cve.imfht.com/detail/CVE-2026-118740"]}],"documents":[{"id":117577,"url":"https://cve.imfht.com/detail/CVE-2026-118740","title":"CVE-2026-118740 (mirror of CVE List V5 record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}