7.8
High
CVE-2026-114148 Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally
Description
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| .NET 10.0 installed on Linux 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 10.0 installed on Mac OS 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 10.0 installed on Windows 10.0 | 10.0.0 → < 10.0.403 | 10.0.403 |
| .NET 11.0 installed on Linux 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
| .NET 11.0 installed on Mac OS 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
| .NET 11.0 installed on Windows 11.0 | 11.0.0-preview.1 → < 11.0.100-rc.3 | 11.0.100-rc.3 |
| .NET 8.0 installed on Linux 8.0 | 8.0.0 → < 8.0.427 | 8.0.427 |
| .NET 8.0 installed on Mac OS 8.0 | 8.0.0 → < 8.0.427 | 8.0.427 |
| .NET 8.0 installed on Windows 8.0 | 8.0.0 → < 8.0.427 | 8.0.427 |
Show the 5 other branches Hide the 5 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| .NET 9.0 installed on Linux 9.0 | 9.0.0 → < 9.0.320 | 9.0.320 |
| .NET 9.0 installed on Mac OS 9.0 | 9.0.0 → < 9.0.320 | 9.0.320 |
| .NET 9.0 installed on Windows 9.0 | 9.0.0 → < 9.0.320 | 9.0.320 |
| .NET source-build Linux tarballs (all archive types) 8.0 | 8.0.100 → < 10.0.403-servicing.26523.112 | 10.0.403-servicing.26523.112 |
| ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) 8.0 | 8.0.0 → < 9.0.22 | 9.0.22 |
References
- ASP.NET Core Elevation of Privilege Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified