CVE-2026-34762

Περιγραφή

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber-s policy while the audit trail records a fabricated or unrelated subscriber IMSI. This issue has been patched in version 1.8.0.