{"id":"EUVD-2026-23553","enisaUuid":"143c918b-467b-30b4-a2b3-aa10b4673be4","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.","datePublished":"Apr 17, 2026, 9:06:09 PM","dateUpdated":"Apr 20, 2026, 1:36:06 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fpj4-9qhx-5m6m\nhttps://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2\n","aliases":"CVE-2026-40305\nGHSA-fpj4-9qhx-5m6m\n","assigner":"GitHub_M","epss":0.18,"enisaIdProduct":[{"id":"f76e92e1-e23c-3467-9136-fe32ba396a35","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"6.0.0, \u003c 10.2.2"}],"enisaIdVendor":[{"id":"5c82f0f4-a5b0-370b-b1b3-380caeedbf5f","vendor":{"name":"DNNSoftware"}}],"enisaIdVulnerability":[{"id":"29498425-f87d-31ed-88aa-af7f8a968b2b","vulnerability":{"id":"CVE-2026-40305","description":"DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2 patches the issue.","datePublished":"Apr 17, 2026, 9:06:09 PM","dateUpdated":"Apr 20, 2026, 1:36:06 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fpj4-9qhx-5m6m\nhttps://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2\n","enisa_id":"EUVD-2026-23553\n","assigner":"GitHub_M","epss":0.18,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"889d8870-74d6-3f81-94ce-9fae8f0a88b2","product":{"name":"Dnn.Platform","vendor":{"name":"DNNSoftware"}},"product_version":"6.0.0, \u003c 10.2.2"}],"vulnerabilityVendor":[{"id":"d865e1a9-e124-38cd-80ad-6d1fd1882776","vendor":{"name":"DNNSoftware"}}]}},{"id":"706ced48-ef63-3dde-9868-0b5b0e158a88","vulnerability":{"id":"GHSA-fpj4-9qhx-5m6m","description":"DNN: Force Friend Request Acceptance","datePublished":"Apr 10, 2026, 9:07:08 PM","dateUpdated":"Apr 24, 2026, 8:50:00 PM","baseScore":0.0,"references":"https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fpj4-9qhx-5m6m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40305\nhttps://github.com/dnnsoftware/Dnn.Platform\nhttps://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2\n","enisa_id":"EUVD-2026-23553\n","aliases":"CVE-2026-40305\nGHSA-fpj4-9qhx-5m6m\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}