CVE-2026-34762: 
vulnerability analysis and mitigation

CVE-2026-34762 is an improper input validation vulnerability in Ella Core (ellanetworks/core) that enables audit log falsification via a path/body IMSI mismatch in the UpdateSubscriber API. The PUT /api/v1/subscriber/{imsi} endpoint accepts an IMSI identifier from both the URL path and the JSON request body without verifying they match, allowing an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated IMSI. Affected versions are all releases up to and including 1.7.0; the issue was patched in version 1.8.0. It carries a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory, Ella Core Advisory).

The root cause is CWE-20 (Improper Input Validation): the API handler for PUT /api/v1/subscriber/{imsi} reads the IMSI from both the URL path parameter and the JSON request body but performs no consistency check between the two values. An authenticated NetworkManager can supply a legitimate target IMSI in the URL path (to select the subscriber whose policy is modified) while placing a different, fabricated IMSI in the request body, which is what the audit log records. Exploitation requires network access to the API and a valid NetworkManager or Admin credential; no special complexity or user interaction is needed beyond authentication (GitHub Advisory, Ella Core Advisory).

The primary impact is an integrity violation: an authenticated NetworkManager or Admin can silently alter any subscriber's QoS policy — potentially degrading service or rerouting traffic — while the audit log attributes the action to a non-existent or unrelated subscriber IMSI. This effectively nullifies post-incident forensic investigations, as searches for the affected subscriber's IMSI will return no matching audit entries. There is no confidentiality or availability impact, and the scope is limited to the affected Ella Core instance (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-34762. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.039% (0.000390), placing it in the 23rd percentile for exploitation likelihood within 30 days (GitHub Advisory). Exploitation is constrained by the requirement for high-privilege authenticated access (NetworkManager or Admin role), significantly limiting the attacker pool.

1. Obtain credentials: Acquire valid NetworkManager or Admin credentials for the target Ella Core instance through phishing, credential theft, or insider access.
2. Identify target subscriber: Enumerate subscribers via the API (e.g., GET /api/v1/subscriber) to identify the IMSI of the subscriber whose policy should be modified.
3. Craft malicious PUT request: Construct a PUT /api/v1/subscriber/{real-target-imsi} request where the URL path contains the actual target subscriber's IMSI, but the JSON request body contains a fabricated or unrelated IMSI along with the desired policy changes.
4. Submit the request: Send the crafted request to the Ella Core API endpoint. The server applies the policy change to the subscriber identified by the path parameter (the real target) but logs the body IMSI as the subject of the change.
5. Verify audit log falsification: Confirm that the audit trail records the fabricated IMSI rather than the actual modified subscriber's IMSI, effectively hiding the unauthorized policy change from forensic review (GitHub Advisory, Ella Core Advisory).

• Logs: Audit log entries for subscriber policy changes referencing IMSIs that do not exist in the subscriber database, or entries where the logged IMSI does not correspond to the subscriber whose policy was actually changed.
• Logs: API access logs showing PUT /api/v1/subscriber/{imsi} requests where the path IMSI and the IMSI in the request body differ (detectable if request body logging is enabled).
• Network: Unexpected or anomalous PUT requests to /api/v1/subscriber/ endpoints from authenticated sessions at unusual times or from unusual source IPs.
• Application: Subscriber QoS policy changes that cannot be reconciled with audit log entries for the affected subscriber's IMSI, indicating a discrepancy between actual state and recorded history (GitHub Advisory).

Upgrade Ella Core to version 1.8.0 or later, which resolves the issue by removing the IMSI from the request body and using the URL path parameter as the sole source of truth for subscriber identification (commit 7f64b7a, PR #1171) (Ella Core v1.8.0 Release). No configuration-based workaround is available for versions ≤ 1.7.0; the only remediation is upgrading. As an interim measure, restrict NetworkManager and Admin API access to trusted, monitored networks and audit API access logs for IMSI discrepancies (GitHub Advisory).