high7.8
CVE-2026-114148
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Impact
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | .NET 9.0 Installed On Mac OS | from 9.0.0 before 9.0.320 |
| Microsoft | .NET Source-Build Linux Tarballs (All Archive Types) | from 8.0.100 before 10.0.403-servicing.26523.112 |
| Microsoft | .NET 11.0 Installed On Mac OS | from 11.0.0-preview.1 before 11.0.100-rc.3 |
| Microsoft | .NET 8.0 Installed On Linux | from 8.0.0 before 8.0.427 |
| Microsoft | .NET 11.0 Installed On Windows | from 11.0.0-preview.1 before 11.0.100-rc.3 |
| Microsoft | .NET 10.0 Installed On Mac OS | from 10.0.0 before 10.0.403 |
| Microsoft | .NET 8.0 Installed On Mac OS | from 8.0.0 before 8.0.427 |
| Microsoft | .NET 10.0 Installed On Windows | from 10.0.0 before 10.0.403 |
| Microsoft | .NET 9.0 Installed On Linux | from 9.0.0 before 9.0.320 |
| Microsoft | .NET 10.0 Installed On Linux | from 10.0.0 before 10.0.403 |
| Microsoft | .NET 8.0 Installed On Windows | from 8.0.0 before 8.0.427 |
| Microsoft | ASP.NET Core Runtime And Targeting-Pack Linux Tarballs (Microsoft-Published) | from 8.0.0 before 9.0.22 |