---
id: "CVE-2026-118740"
page: "https://infrastack.ai/live/CVE-2026-118740"
kind: "vulnerability"
aliases: ["CVE-2026-118740"]
title: "Aspire: missing authorization lets unauthenticated network attackers bypass a security feature"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Aspire", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Aspire Dashboard", "fixed": [], "affected": ">= 13.6.1, <= 13.6.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aspire", "aspire-dashboard", "dotnet", "network", "other"]
not_affected_if: []
published_at: "2026-11-10T19:19:50+00:00"
first_seen_at: "2026-11-10T19:24:55+00:00"
updated_at: "2026-11-10T19:33:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118740", "first_seen_at": "2026-11-10T19:24:55+00:00"}, {"source": "analyst", "url": "https://cve.imfht.com/detail/CVE-2026-118740", "first_seen_at": "2026-11-10T19:33:37+00:00", "cites": ["https://cve.imfht.com/detail/CVE-2026-118740"]}]
exploit_sources: []
---

# Aspire: missing authorization lets unauthenticated network attackers bypass a security feature

Link for people: https://infrastack.ai/live/CVE-2026-118740 (this .md is for agents)

Aspire has a missing authorization check that lets an unauthorized attacker bypass a security feature over the network. The sources do not say which security feature or what an attacker can do after bypassing it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Aspire affected range not listed fixed no fixed version listed
- vendor:Aspire Dashboard affected >= 13.6.1, <= 13.6.5 fixed no fixed version listed

## How to check

Run 'aspire --version', or check your Aspire.AppHost.Sdk and Aspire.Dashboard.Sdk package versions. If any is 13.6.1 to 13.6.5 and the dashboard is reachable from a network other than localhost, treat it as exposed. The range comes from a mirror, not the vendor; confirm it against the MSRC or GitHub advisory.

## Timeline

- 2026-11-10T19:24:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118740
- 2026-11-10T19:33:37+00:00 analyst https://cve.imfht.com/detail/CVE-2026-118740 — NVD and MSRC pages returned nothing, and no Microsoft or GitHub advisory was found. The only source is a mirror of the CVE List V5 record (assigned by Microsoft, CVSS 9.1, AV:N/PR:N, CWE missing authorization). It gives 13.6.1 to 13.6.5 as affected, with no fixed version and no named feature. The latest GitHub release seen was 13.6.4, so 13.6.5 could not be confirmed. Nothing is marked verified. Revisit when the MSRC or GitHub advisory appears.

## Documents

- [describes] CVE-2026-118740 (mirror of CVE List V5 record) https://cve.imfht.com/detail/CVE-2026-118740

## From the sources

Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_