CVE-2026-34762

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34762", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T19:17:10.225Z", "datePublished": "2026-04-02T19:03:54.247Z", "dateUpdated": "2026-04-03T15:39:50.305Z"}, "containers": {"cna": {"title": "Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f"}, {"name": "https://github.com/ellanetworks/core/releases/tag/v1.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/ellanetworks/core/releases/tag/v1.8.0"}], "affected": [{"vendor": "ellanetworks", "product": "core", "versions": [{"version": "< 1.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T19:03:54.247Z"}, "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0."}], "source": {"advisory": "GHSA-xw45-cc32-442f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T15:39:42.759798Z", "id": "CVE-2026-34762", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T15:39:50.305Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34762", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T15:39:42.759798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T15:39:47.283Z"}}], "cna": {"title": "Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber", "source": {"advisory": "GHSA-xw45-cc32-442f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ellanetworks", "product": "core", "versions": [{"status": "affected", "version": "< 1.8.0"}]}], "references": [{"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f", "name": "https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ellanetworks/core/releases/tag/v1.8.0", "name": "https://github.com/ellanetworks/core/releases/tag/v1.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T19:03:54.247Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34762", "state": "PUBLISHED", "dateUpdated": "2026-04-03T15:39:50.305Z", "dateReserved": "2026-03-30T19:17:10.225Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-02T19:03:54.247Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "core", "vendor": "ellanetworks", "versions": [{"status": "affected", "version": "< 1.8.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ellanetworks:ella_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "F79EF764-4DAE-481E-9B49-974F342B1860", "versionEndExcluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0."}, {"lang": "es", "value": "Ella Core es un n\u00facleo 5G dise\u00f1ado para redes privadas. Antes de la versi\u00f3n 1.8.0, la API PUT /api/v1/subscriber/{imsi} acepta un identificador IMSI tanto de la ruta URL como del cuerpo de la solicitud JSON, pero nunca verifica que coincidan. Esto permite a un NetworkManager autenticado modificar la pol\u00edtica de cualquier suscriptor mientras que el registro de auditor\u00eda registra un IMSI de suscriptor fabricado o no relacionado. Este problema ha sido parcheado en la versi\u00f3n 1.8.0."}], "id": "CVE-2026-34762", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34762", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-03T15:39:42.759798Z", "version": "2.0.3"}}]}, "published": "2026-04-02T20:16:25.947", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ellanetworks/core/releases/tag/v1.8.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "core", "source": "cna", "vendor": "ellanetworks"}, "product": "core", "vendor": "ellanetworks"}], "analysis": {"en": {"generated_at": "2026-04-07T23:29:54.289081+00:00", "value": {"mitigation_remediation": ["Upgrade Ella Core to version\u202f1.8.0 or later to apply the audit log verification fix.", "If an immediate upgrade is not feasible, restrict NetworkManager privileges and review audit logs for inconsistencies.", "Verify that audit trail entries match subscriber IMSI values after applying the patch."], "summary": {"action": "Apply Patch", "impact": "Audit Log Falsification"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Ella Networks Ella Core, a 5G core designed for private networks. All releases before version\u202f1.8.0 are impacted; the issue is resolved in version\u202f1.8.0 and later. The patch is available in the v1.8.0 release and is documented in the official advisories.", "description_and_impact": "Ella Core\u2019s PUT /api/v1/subscriber/{imsi} endpoint accepts an IMSI value from both the URL path and the JSON request body but never verifies that the two match. An authenticated NetworkManager can therefore modify any subscriber\u2019s policy while the audit trail records a fabricated or unrelated subscriber IMSI, allowing policy changes to go unnoticed and compromising the integrity of the system\u2019s audit logging.", "risk_and_exploitability": "The CVSS score of 2.7 denotes low severity, and the EPSS score of less than 1\u202f% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access as a NetworkManager, so the threat is limited to users with elevated privileges, but the ability to falsify audit logs could undermine trust in compliance and forensic investigations."}}}}, "created": "2026-04-03T07:31:32.165184+00:00", "updated": "2026-04-08T19:54:26.812196+00:00", "vendors": ["ellanetworks", "ellanetworks$PRODUCT$core"]}