{"id":"GHSA-2f3w-v7f5-vpgx","kind":"vulnerability","aliases":["GHSA-2f3w-v7f5-vpgx"],"related":[],"title":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-118740 - Aspire Security Feature Bypass Vulnerability","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-4g86-54fm-h9h8. This link is maintained to preserve external references.\n\n## Original Description\nMissing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.","summary":"Aspire.Dashboard.Sdk.linux-x64 is missing an authorization check, so an unauthorized attacker on the network can bypass a security feature. This advisory is withdrawn as a duplicate of GHSA-4g86-54fm-h9h8, which carries the live record.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Aspire.Dashboard.Sdk.linux-x64","fixed":[],"affected":"< 13.6.5","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["aspire","cwe-862","dotnet","nuget","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"withdrawn","published_at":"2026-11-10T21:33:09+00:00","first_seen_at":"2026-11-12T17:17:56+00:00","triaged_at":"2026-11-12T17:18:49+00:00","updated_at":"2026-11-12T17:18:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-12T17:18:49Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Aspire dashboard: missing authorization lets an attacker bypass a security feature","impact":"medium","summary":"Aspire.Dashboard.Sdk.linux-x64 is missing an authorization check, so an unauthorized attacker on the network can bypass a security feature. This advisory is withdrawn as a duplicate of GHSA-4g86-54fm-h9h8, which carries the live record.","audience":"developers","category":"package","nicknames":[],"who_cares":["aspire","dotnet","nuget"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized network attacker bypasses a security feature","analyst_note":"Withdrawn duplicate; confirm details and fixed version in GHSA-4g86-54fm-h9h8 and map this record to it.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources list Aspire.Dashboard.Sdk.linux-x64 below 13.6.5 as affected, with no fixed version given for this record. The advisory is withdrawn and points to GHSA-4g86-54fm-h9h8 for the current details, so check that record before acting on this one.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4640,"output_tokens":502,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-118740':8A '-2026':7A '-862':28B '2f3w':16A,21A '4g86':61B,84C '54fm':62B,85C 'advisori':2A,5A,52B,70C,72C 'allow':101C 'aspir':9A,26B,100C 'aspire.dashboard.sdk.linux':24A,32B 'attack':42B,104C 'author':37B,98C 'bypass':12A,47B,106C 'carri':65B 'check':38B 'cve':6A 'cwe':27B 'descript':96C 'dotnet':29B 'duplic':1A,57B,69C,80C 'extern':93C 'featur':11A,50B,109C 'ghsa':15A,20A,60B,83C 'ghsa-2f3w-v7f5-vpgx':14A,19A 'ghsa-4g86-54fm-h9h8':59B,82C 'h9h8':63B,86C 'link':88C 'live':67B 'maintain':90C 'microsoft':3A 'miss':35B,97C 'network':45B,112C 'nuget':30B 'origin':95C 'packag':31B 'preserv':92C 'record':68B 'refer':94C 'secur':4A,10A,49B,108C 'unauthor':41B,103C 'v7f5':17A,22A 'vpgx':18A,23A 'vulner':13A 'withdrawn':54B,75C 'x64':25A,33B","nicknames":[],"mitigations":[],"who_affected":"The sources list Aspire.Dashboard.Sdk.linux-x64 below 13.6.5 as affected, with no fixed version given for this record. The advisory is withdrawn and points to GHSA-4g86-54fm-h9h8 for the current details, so check that record before acting on this one.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["aspiredashboardsdklinuxx64"],"ptokens":["aspire","dashboard","linux","sdk","x64"],"labels":["aspire","critical","cwe862","dotnet","nuget","package"],"campaign_type":null,"search_a":"'-118740':8A '-2026':7A '2f3w':16A,21A 'advisori':2A,5A 'aspir':9A 'aspire.dashboard.sdk.linux':24A 'bypass':12A 'cve':6A 'duplic':1A 'featur':11A 'ghsa':15A,20A 'ghsa-2f3w-v7f5-vpgx':14A,19A 'microsoft':3A 'secur':4A,10A 'v7f5':17A,22A 'vpgx':18A,23A 'vulner':13A 'x64':25A","search_b":"'-862':28B '4g86':61B '54fm':62B 'advisori':52B 'aspir':26B 'aspire.dashboard.sdk.linux':32B 'attack':42B 'author':37B 'bypass':47B 'carri':65B 'check':38B 'cwe':27B 'dotnet':29B 'duplic':57B 'featur':50B 'ghsa':60B 'ghsa-4g86-54fm-h9h8':59B 'h9h8':63B 'live':67B 'miss':35B 'network':45B 'nuget':30B 'packag':31B 'record':68B 'secur':49B 'unauthor':41B 'withdrawn':54B 'x64':33B","search_c":"'4g86':84C '54fm':85C 'advisori':70C,72C 'allow':101C 'aspir':100C 'attack':104C 'author':98C 'bypass':106C 'descript':96C 'duplic':69C,80C 'extern':93C 'featur':109C 'ghsa':83C 'ghsa-4g86-54fm-h9h8':82C 'h9h8':86C 'link':88C 'maintain':90C 'miss':97C 'network':112C 'origin':95C 'preserv':92C 'refer':94C 'secur':108C 'unauthor':103C 'withdrawn':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:33:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2f3w-v7f5-vpgx","url":"https://github.com/advisories/GHSA-2f3w-v7f5-vpgx","severity":"critical","published_at":"2026-11-10T21:33:09+00:00","modified_at":"2026-11-12T17:17:38+00:00","first_seen_at":"2026-11-12T17:17:56+00:00","fetched_at":"2026-11-12T17:17:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}