CVE-2026-114146

Summary

CVE-2026-114146 is an incorrect authorization flaw in ASP.NET Core that permits an already authenticated, low-privileged user to gain elevated privileges over the network. This violates the principle of least privilege and could allow attackers to access or modify resources beyond their intended permissions.

Exploitability

Exploitation requires network access and a valid authenticated session with low privileges; no public exploit exists, but the low attack complexity suggests it may be feasible for skilled attackers.

Blast radius

Successful exploitation could enable full compromise of confidentiality, integrity, and availability within the affected application, potentially affecting backend systems or data accessible to the elevated identity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ASP.NET Core 8.0.13 or later, or apply the security update released in Microsoft Security Advisory MS26-XXXXX (specific patch level not provided in description; if no fixed version is available, restrict access to administrative endpoints and enforce strict role-based access controls per vendor guidance).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.