CVE-2026-42083: free5GC PCF missing authorization in SMPolicyControl and UEPolicyControl

Executive brief

A vulnerability in the free5GC Policy Control Function (PCF) allows unauthorized access to mobile subscriber session policies. The PCF is a core component of 5G networks responsible for managing policy rules for subscriber data sessions. An attacker with network access to the PCF can bypass security checks to view or modify session policies and leak sensitive subscriber identifiers (SUPI), potentially compromising user privacy and network operations.

Technical details

The free5GC Policy Control Function (PCF) fails to apply the 'RouterAuthorizationCheck' middleware to the 'smPolicyGroup' route group within the Npcf_SMPolicyControl service. This omission allows unauthenticated network requests to reach sensitive business logic handlers for session management policies. An attacker can exploit this to perform POST, GET, and DELETE operations on SM policies without a valid OAuth token. Successful exploitation can lead to the disclosure of the Subscription Permanent Identifier (SUPI) and other policy context data. The issue is fixed in version 1.4.3 by correctly attaching the authorization middleware to the affected route groups.

Affected products

• free5gc pcf < 1.4.3

Timeline

• 2026-05-07: advisory: GHSA-6rgm-gr97-x3j5 published
• 2026-05-07: disclosed
• 2026-05-27: other: NVD published CVE-2026-42083

References

• https://api.github.com/users/LinZiyuu
• https://github.com/LinZiyuu
• https://api.github.com/users/LinZiyuu/gists%7B/gist_id%7D
• https://api.github.com/users/LinZiyuu/repos
• https://avatars.githubusercontent.com/u/104151270?v=4
• https://api.github.com/users/LinZiyuu/events%7B/privacy%7D