CVE-2026-118740

Summary

Missing authorization in Aspire allows unauthenticated remote attackers to bypass a security control over the network, potentially gaining unauthorized access to protected resources or functionality. This flaw is rated critical (CVSS 9.1) due to high confidentiality and integrity impact with no authentication required.

Exploitability

Exploitation requires only network access to the vulnerable endpoint; no authentication or user interaction is needed, making it trivial for remote attackers.

Blast radius

Successful exploitation could allow an attacker to read or modify sensitive data, escalate privileges, or compromise system integrity without detection, depending on the specific security feature bypassed.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version or patch level is specified in the published description; apply vendor-recommended workarounds immediately—restrict access to the affected endpoint via network segmentation or firewall rules—and monitor for unauthorized access attempts until a patch is released.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.