CVE-2026-105444: dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-99

Description

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

dotnet eShop: .NET 8

References

https://github.com/dotnet/eShop/
https://github.com/dotnet/eShop/issues/996
https://vuldb.com/cve/CVE-2026-105444
https://vuldb.com/submit/984283
https://vuldb.com/vuln/413608
https://vuldb.com/vuln/413608/cti

Get alerted when CVE-2026-105444 or the next vulnerability affects your stack