CVE-2026-47780

Name of the Vulnerable Software and Affected Versions free5GC UDR (affected versions not specified)

Description Improper input validation exists in the EE subscription handlers of the free5GC UDR. The system uses a regular expression to validate the ueId variable that includes a catch-all alternative, allowing any non-empty string to be accepted instead of restricting input to valid 3GPP identifier formats such as IMSI, NAI, MSISDN, EXTID, GCI, or GLI. This allows an attacker with access to the UDR Service Based Interface (SBI) to submit, persist, and retrieve arbitrary identifiers, leading to unauthorized data creation and corruption of the UDR data store. The issue is present in the HandleCreateEeSubscriptions and HandleQueryeesubscriptions functions within the api datarepository.go file and affects the following endpoints:

Recommendations Remove the trailing |. + branch from the regular expression used to validate the ueId variable in the HandleCreateEeSubscriptions and HandleQueryeesubscriptions functions to ensure only explicitly supported identifier formats are accepted. Restrict access to the UDR SBI endpoints to minimize the risk of unauthorized identifier injection.