CVE-2026-33906

Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.7.0

Description Ella Core is a 5G core designed for private networks. The NetworkManager role had backup and restore permissions. The restore endpoint accepted any valid SQLite file without content verification. This allowed a NetworkManager to replace the production database with a modified copy, escalating privileges to Admin. This granted access to user management, audit logs, debug endpoints, and operator identity configuration, which the role was explicitly denied. The affected endpoint is /restore. The vulnerable parameter is the SQLite file provided to the /restore endpoint.

Recommendations Update to version 1.7.0 or later.