In the UDR service of free5GC, the delete handler for Traffic Influence Subscriptions verifies that the influenceId in the URL is "subs-to-notify" but fails to abort execution after returning a 404 response when validation fails. As a result, regardless of the supplied influenceId value, the handler continues and removes the subscription from the system. The flaw permits an attacker without authentication to delete any Traffic Influence Subscriptions simply by issuing a delete request to the 5G Service Based Interface. The API misleads the caller with a 404 response while the subscription is actually removed, masking the action.

The vulnerability affects the free5gc UDR service in versions 1.4.2 and earlier. Only the free5gc:free5gc product is impacted; other free5gc components are unaffected.

The CVSS score of 8.7 marks this as high severity, and its EPSS score is not available; the issue has not been catalogued in KEV. An unauthenticated attacker can exploit the flaw by sending a delete request over the 5G Service Based Interface. Because no authentication or authorization check is performed, the attacker can target any Traffic Influence Subscription, potentially disrupting service notifications or traffic management policies.