Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-37233: FlexRIC v2.0.0: Malicious app can delete other apps' subscriptions
CVE-2026-37233 · published 5 months ago
Summary
A bug in FlexRIC v2.0.0 allows a malicious application to delete the subscriptions of other applications. This is a security risk because it breaks the isolation between different applications, which can lead to data being deleted or modified unintentionally. To protect your applications, update to the latest version of FlexRIC.
Original advisory text
FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself ...
FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.5
High
Type
CWE-617Reachable Assertion
Timeline
Published1 Jun 2026
Updated4 Nov 2026
First seen1 Jun 2026
Sources
CVE-2026-37233 · NVD
Track software like this
Free during beta