Weak Validation in Free5GC Leads to Unauthorized Data Creation

CVE-2026-47780

What is CVE-2026-47780?

Free5GC, an open-source implementation of the 5G core network, presents a significant issue in versions 4.2.3 and earlier due to improper validation of the ueId path value. The current regex implementation allows non-empty strings to pass validation, failing to restrict identifiers to the supported SUPI and GPSI formats. This flaw enables potential abuse where an attacker, with network accessibility to the UDR SBI, can submit invalid identifiers to the subscription data endpoint, which may lead to unauthorized data creation, persistent corruption of subscription records, and the risk of UDR namespace pollution. Such vulnerabilities are particularly concerning in environments with loose access controls where UDR can be directly accessed, increasing the risk of affecting downstream components that depend on valid identifier formats.

References