Ella Core’s PUT /api/v1/subscriber/{imsi} endpoint accepts an IMSI value from both the URL path and the JSON request body but never verifies that the two match. An authenticated NetworkManager can therefore modify any subscriber’s policy while the audit trail records a fabricated or unrelated subscriber IMSI, allowing policy changes to go unnoticed and compromising the integrity of the system’s audit logging.

The vulnerability affects Ella Networks Ella Core, a 5G core designed for private networks. All releases before version 1.8.0 are impacted; the issue is resolved in version 1.8.0 and later. The patch is available in the v1.8.0 release and is documented in the official advisories.

The CVSS score of 2.7 denotes low severity, and the EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access as a NetworkManager, so the threat is limited to users with elevated privileges, but the ability to falsify audit logs could undermine trust in compliance and forensic investigations.