dotnet eShop EUVD-2026-92801

Requires a valid authenticated low-privilege account (PR:L) on an eShop deployment's Ordering API; the attacker then supplies a manipulated OrderNumber value to the GetOrderAsync endpoint to reference order resources owned by other users. Limiting factors that sharply reduce realistic risk: (1) authentication is required, so purely anonymous access is not sufficient; (2) the impact is limited to reading order identifiers/records (information disclosure), not code execution or data modification; and (3) dotnet/eShop is a reference sample application rarely run in production, so exploitable instances are uncommon. No patched version exists because the maintainers have not yet responded to the report.

This is a low-real-risk issue despite being remotely reachable. The VulDB-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, and all impact metrics are Low (VC:L/VI:L/VA:L) with no subsequent-system impact. The flaw is an IDOR-style 'improper control of resource identifiers' (CWE-99) in the GetOrderAsync function, tagged by VulDB as Information Disclosure - consistent with an authenticated (PR:L) low-privilege user manipulating the OrderNumber argument to read order records belonging to other users. The exploit-maturity metric E:P indicates a proof-of-concept exists, but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The single most important risk-reducing factor is the affected product itself: dotnet/eShop is Microsoft's open-source .NET microservices REFERENCE/SAMPLE application, not production software, so real-world attack surface is minimal. Note a conflict to verify: VulDB's auto-generated vector asserts VI:L and VA:L (integrity and availability impact), but the description and Information Disclosure tag describe only unauthorized read of resource identifiers - the integrity/availability impacts appear to be VulDB default padding rather than demonstrated effects.

An attacker who holds a valid low-privilege account on an eShop deployment calls the Ordering API's order-retrieval endpoint and tampers with the OrderNumber argument passed to GetOrderAsync, causing the API to return order details belonging to a different user. A proof-of-concept is indicated by the CVSS exploit-maturity value (E:P), and because the vector is network-reachable with low complexity, no special tooling is needed beyond an authenticated session.