Resource Injection Vulnerability in dotnet eShop Ordering API
CVE-2026-105444

5.3MEDIUM

Key Information:

Vendor

Dotnet

Status
Eshop
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105444?

A security flaw has been identified in the dotnet eShop's Ordering API, specifically in the GetOrderAsync function found in the src/Ordering.API/Apis/OrdersApi.cs file. This vulnerability allows for the manipulation of the OrderNumber parameter, leading to improper control of resource identifiers. Attackers can exploit this issue remotely, potentially compromising the integrity of the application. Despite being notified of this security concern through an issue report, there has been no response from the project maintainers.

Affected Version(s)

eShop .NET 8

References

https://vuldb.com/vuln/413608
vdb-entrytechnical-description
https://vuldb.com/vuln/413608/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-105444
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

geochen (VulDB User)
VulDB CNA Team
.