CVE-2026-40305

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2	Release Notes
https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fpj4-9qhx-5m6m	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) DNN (anteriormente DotNetNuke) es una plataforma de gestión de contenido web de código abierto (CMS) en el ecosistema de Microsoft. A partir de la versión 6.0.0 y antes de la versión 10.2.2, en la función de amigos, un usuario podía elaborar una solicitud que forzaría la aceptación de una solicitud de amistad en otro usuario. La versión 10.2.2 corrige el problema.

Information

Published : 2026-04-17 22:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40305

Mitre link : CVE-2026-40305

CVE.ORG link : CVE-2026-40305

JSON object : View

Products Affected

dnnsoftware

dotnetnuke

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-40305", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40305", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T13:22:45.395312Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dnnsoftware", "product": "Dnn.Platform", "versions": [{"status": "affected", "version": ">= 6.0.0, < 10.2.2"}]}]}], "published": "2026-04-17T22:16:32.370", "references": [{"url": "https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fpj4-9qhx-5m6m", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue."}, {"lang": "es", "value": "DNN (anteriormente DotNetNuke) es una plataforma de gesti\u00f3n de contenido web de c\u00f3digo abierto (CMS) en el ecosistema de Microsoft. A partir de la versi\u00f3n 6.0.0 y antes de la versi\u00f3n 10.2.2, en la funci\u00f3n de amigos, un usuario pod\u00eda elaborar una solicitud que forzar\u00eda la aceptaci\u00f3n de una solicitud de amistad en otro usuario. La versi\u00f3n 10.2.2 corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC215956-96A5-48C9-86DC-44E23E439AC0", "versionEndExcluding": "10.2.2", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}