CVE-2026-40246: webconsole through 1.4.2 (inclusive); +1 more affected products

CVE-2026-40246. CVSS 3.1 base score 7.5 (HIGH, NVD). EPSS 0.0045 (percentile 0.37788), scored 19-Oct-2026.

Affected technology

webconsole · through 1.4.2 (inclusive)
free5gc

free5gc · <= 1.4.2
free5gc

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker with access to the 5G Service Based Interface can delete arbitrary Traffic Influence Subscriptions by supplying any value for the influenceId path segment, while the API misleadingly returns a 404 Not Found response. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.

Published 20-Oct-2026 16:40 UTC

CWE: CWE-285
CCR priority: 30.1 /100 (P4)
CVSS 3.1: 7.5 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · NVD
EPSS: 0.0045 · percentile 0.37788 · 2026-10-19
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-20 16:40:23.998050+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-40246.html