FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.
References
| Link | Resource |
|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37233.md | Exploit Mitigation Third Party Advisory |
| https://gitlab.eurecom.fr/mosaic5g/flexric | Product |
Configurations
History
03 Jun 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mosaic5g:flexric:2.0.0:*:*:*:*:*:*:* | |
| First Time |
Mosaic5g flexric
Mosaic5g |
|
| References | () https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37233.md - Exploit, Mitigation, Third Party Advisory | |
| References | () https://gitlab.eurecom.fr/mosaic5g/flexric - Product |
02 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-617 |
01 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-01 19:16
Updated : 2026-06-03 17:16
NVD link : CVE-2026-37233
Mitre link : CVE-2026-37233
CVE.ORG link : CVE-2026-37233
JSON object : View
Products Affected
mosaic5g
- flexric
CWE
CWE-617
Reachable Assertion