CVE-2026-3263

go2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization

View on CVE.org
Published Feb 26, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected by this vulnerability is an unknown functionality of the file /api/Security/ of the component Security API. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability enables improper authorization in the Security API of the Asp.Net-Core-Inventory-Order-Management-System. By manipulating requests to the /api/Security/ endpoint, an attacker can bypass access controls and gain unauthorized access to protected resources, potentially leading to full system compromise. This flaw manifests as a lack of proper authentication checks, fitting CWE-266 (Improper Privilege Management) and CWE-285 (Improper Authorization).

Affected Systems

Affected product: go2ismail Asp.Net-Core-Inventory-Order-Management-System, versions up to and including 9.20250118. The vulnerability pertains to components within the Security API exposed via the /api/Security/ path. No other vendor or product variants are listed as impacted.

Risk and Exploitability

The severity assigned by CVSS is 5.3, indicating a moderate impact, while the EPSS score is below 1%, reflecting a low but non‑zero likelihood of exploitation in the environment. The vulnerability is not yet present in CISA's KEV catalog. The likely attack vector is remote, as the flaw can be triggered by external request manipulation to the Security API. An attacker would need to construct a crafted request lacking proper authorization, which the system currently fails to validate and which can be performed over the network.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch or upgrade to a non‑vulnerable version as soon as one becomes available.
  • If no patch is available, block external access to the /api/Security/ endpoint using a firewall or network segmentation, restricting it to trusted IP ranges.
  • Implement or enforce role‑based access controls within the application to ensure that only authorized users can invoke the Security API, addressing the underlying CWE‑266 and CWE‑285 weaknesses.

Generated by OpenCVE AI on April 17, 2026 at 14:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:go2ismail:asp.net-core-inventory-order-management-system:*:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Go2ismail
Go2ismail asp.net-core-inventory-order-management-system
Vendors & Products Go2ismail
Go2ismail asp.net-core-inventory-order-management-system
Type Values Removed Values Added
Description A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected by this vulnerability is an unknown functionality of the file /api/Security/ of the component Security API. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Title go2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization
Weaknesses CWE-266
CWE-285
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Mar 3, 2026, 2:43 PM
Reserved
Feb 26, 2026, 2:39 PM

View source JSON

Updated
Mar 3, 2026, 2:43 PM

JSON

Status
Analyzed
Published
Feb 26, 2026, 10:20 PM
Modified
Jun 17, 2026, 10:43 AM

View source JSON

No data.

Updated
Apr 17, 2026, 2:15 PM

JSON