CVE-2026-105444: Improper Control of Resource Identifiers in dotnet eShop

This vulnerability involves improper control of resource identifiers in the GetOrderAsync function within src/Ordering.API/Apis/OrdersApi.cs of the dotnet eShop .NET 8 Ordering API component. An attacker can manipulate the OrderNumber argument remotely to exploit this flaw. The issue was reported early to the project but no official response or remediation has been provided. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

The vulnerability allows remote attackers to manipulate resource identifiers improperly, potentially leading to unauthorized access or manipulation of order data within the Ordering API. The exact impact details are not provided, but the medium CVSS score reflects a moderate risk due to ease of exploitation and potential data exposure or integrity issues.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded yet, monitor official dotnet channels for updates and consider implementing temporary access controls or input validation on the OrderNumber parameter as a precaution.