CVE-2026-34762

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ellanetworks/core/releases/tag/v1.8.0	Release Notes
https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ellanetworks:ella_core:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-02 20:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34762

Mitre link : CVE-2026-34762

CVE.ORG link : CVE-2026-34762

JSON object : View

Products Affected

ellanetworks

ella_core

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-34762", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34762", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T15:39:42.759798Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ellanetworks", "product": "core", "versions": [{"status": "affected", "version": "< 1.8.0"}]}]}], "published": "2026-04-02T20:16:25.947", "references": [{"url": "https://github.com/ellanetworks/core/releases/tag/v1.8.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0."}, {"lang": "es", "value": "Ella Core es un n\u00facleo 5G dise\u00f1ado para redes privadas. Antes de la versi\u00f3n 1.8.0, la API PUT /api/v1/subscriber/{imsi} acepta un identificador IMSI tanto de la ruta URL como del cuerpo de la solicitud JSON, pero nunca verifica que coincidan. Esto permite a un NetworkManager autenticado modificar la pol\u00edtica de cualquier suscriptor mientras que el registro de auditor\u00eda registra un IMSI de suscriptor fabricado o no relacionado. Este problema ha sido parcheado en la versi\u00f3n 1.8.0."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ellanetworks:ella_core:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F79EF764-4DAE-481E-9B49-974F342B1860", "versionEndExcluding": "1.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}