CVE-2026-70183

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

An elevation of privilege flaw, rated IMPORTANT by Red Hat Product Security, was found in the Blazor AuthorizeRouteView component of ASP.NET Core. Due to improper synchronization of concurrent execution using a shared resource (a race condition), a stale asynchronous authorization result can be applied after navigation or an authorization-state change, bypassing the current [Authorize] decision. An authorized remote attacker with low privileges could exploit this issue over a network, with high attack complexity, to elevate privileges within the application, affecting confidentiality, integrity, and availability (CVSS 3.1: 7.5, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Red Hat products that ship the affected ASP.NET Core Runtime, tracked under the dotnet, dotnet8.0, dotnet9.0, and dotnet10.0 components, are affected across the impacted streams and a fix is being pursued. The Red Hat severity assessment (IMPORTANT, CVSS 7.5) is consistent with the upstream CVSS score of 7.5.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream advisory states that the issue is fixed in ASP.NET Core Runtime 8.0.32, 9.0.21, and 10.0.13 (and 11.0.0-rc.2 for the .NET 11 pre-release channel); users should apply the patched versions of the affected .NET components for their Red Hat offerings once available.