CVE-2026-34762

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ellanetworks/core/releases/tag/v1.8.0	Release Notes
https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ellanetworks:ella_core:*:*:*:*:*:*:*:*

History

24 Jul 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Ella Core es un núcleo 5G diseñado para redes privadas. Antes de la versión 1.8.0, la API PUT /api/v1/subscriber/{imsi} acepta un identificador IMSI tanto de la ruta URL como del cuerpo de la solicitud JSON, pero nunca verifica que coincidan. Esto permite a un NetworkManager autenticado modificar la política de cualquier suscriptor mientras que el registro de auditoría registra un IMSI de suscriptor fabricado o no relacionado. Este problema ha sido parcheado en la versión 1.8.0.

07 Apr 2026, 16:51

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ellanetworks:ella_core::::::::
References	~~() https://github.com/ellanetworks/core/releases/tag/v1.8.0 -~~	() https://github.com/ellanetworks/core/releases/tag/v1.8.0 - Release Notes
References	~~() https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f -~~	() https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f - Vendor Advisory
First Time		Ellanetworks Ellanetworks ella Core

02 Apr 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-02 20:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34762

Mitre link : CVE-2026-34762

CVE.ORG link : CVE-2026-34762

JSON object : View

Products Affected

ellanetworks

ella_core

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-34762", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34762", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T15:39:42.759798Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ellanetworks", "product": "core", "versions": [{"status": "affected", "version": "< 1.8.0"}]}]}], "published": "2026-04-02T20:16:25.947", "references": [{"url": "https://github.com/ellanetworks/core/releases/tag/v1.8.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-xw45-cc32-442f", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0."}, {"lang": "es", "value": "Ella Core es un n\u00facleo 5G dise\u00f1ado para redes privadas. Antes de la versi\u00f3n 1.8.0, la API PUT /api/v1/subscriber/{imsi} acepta un identificador IMSI tanto de la ruta URL como del cuerpo de la solicitud JSON, pero nunca verifica que coincidan. Esto permite a un NetworkManager autenticado modificar la pol\u00edtica de cualquier suscriptor mientras que el registro de auditor\u00eda registra un IMSI de suscriptor fabricado o no relacionado. Este problema ha sido parcheado en la versi\u00f3n 1.8.0."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ellanetworks:ella_core:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F79EF764-4DAE-481E-9B49-974F342B1860", "versionEndExcluding": "1.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}