{"id":"CVE-2026-40305","sourceIdentifier":"security-advisories@github.com","published":"2026-04-17T22:16:32.370","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue."},{"lang":"es","value":"DNN (anteriormente DotNetNuke) es una plataforma de gestión de contenido web de código abierto (CMS) en el ecosistema de Microsoft. A partir de la versión 6.0.0 y antes de la versión 10.2.2, en la función de amigos, un usuario podía elaborar una solicitud que forzaría la aceptación de una solicitud de amistad en otro usuario. La versión 10.2.2 corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"dnnsoftware","product":"Dnn.Platform","versions":[{"version":">= 6.0.0, < 10.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-20T13:22:45.395312Z","id":"CVE-2026-40305","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dnnsoftware:dotnetnuke:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"10.2.2","matchCriteriaId":"FC215956-96A5-48C9-86DC-44E23E439AC0"}]}]}],"references":[{"url":"https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fpj4-9qhx-5m6m","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}