Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
27 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Content Delivery API enforces member / Public Access protection only at the controller layer, against the node that is directly requested. When a public (unprotected) node references a protected node through a Content Picker or Multi-Node Tree Picker (including those nested inside Block List, Block Grid, or Rich Text Editor blocks), the Delivery API expands and serializes the protected node with no access check applied. Similarly, configuration based restrictions based on aliases of allowed or disallowed content types are by-passed for referenced content items that are retrieved via property expansion. As a result, an anonymous / unauthorized caller can retrieve a protected node's: - Name, route, and id — always, even without expansion, and - Full property values — when the request uses ?expand on the picker property. A direct request for the same protected node correctly returns 401 Unauthorized, which makes the leak easy to miss: the protection appears to work, but is bypassed…
Recommended action: Upgrade to 18.0.2, 17.5.3 or 13.15.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Authenticated users are able to inject HTML vulnerability into an input field, which is rendered in the confirmation dialog without proper output encoding. Patches This issue has been patched in 17.4.0
Recommended action: Upgrade to 17.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. Patches The issue is resolved in versions 17.4.0 and 13.14.0. Workarounds If users cannot upgrade immediately, they can mitigate the issue in their own site by ensuring every Razor form that posts to UmbLoginStatusController, UmbProfileController or UmbRegisterController passes a concrete, trusted RedirectUrl into Html.BeginUmbracoForm's route values. For example: Resources https://github.com/umbraco/Umbraco-CMS/pull/22565 https://github.com/umbraco/Umbraco-CMS/pull/22561
Recommended action: Upgrade to 17.4.0 or 13.14.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships. The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles. Impact An authenticated backoffice user may be able to escalate their privileges to Administrator level. Successful exploitation results in full administrative control of the affected Umbraco CMS instance, including unrestricted access to content, user management, and configuration settings. The impact is significantly mitigated by the fact that this can only be exploited by a user that has already been given access to the "Users" section in the CMS. For most Umbraco setups, such users are already also "Administrators". Patches The issue is patched in 16.5.1 and…
Recommended action: Upgrade to 17.2.2 or 16.5.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes). Impact An attacker can modify domain configurations for content nodes they are not permitted to edit. This may result in malicious or unintended routing behaviour, service disruption, and potential disclosure of configuration-related information. Patches The issue is patched in 16.5.1 and 17.2.2. Workarounds There is no workaround other than upgrading.
Recommended action: Upgrade to 17.2.2 or 16.5.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Due to unsafe handling and deletion of temporary files during the dictionary upload process, an attacker with access to the backoffice can trigger predictable requests to temporary file paths. The application’s error responses (HTTP 500 when a file exists, 404 when it does not) allow the attacker to enumerate the existence of arbitrary files on the server’s filesystem. This vulnerability does not allow reading or writing file contents. In certain configurations, incomplete clean-up of temporary upload files may additionally expose the NTLM hash of the Windows account running the Umbraco application. The direct impact of this vulnerability is therefore limited to confidentiality, which is reflected in its CVSS base score of 4.9 While the CVSS Base Score captures only the immediate effect, the practical risk varies significantly based on hosting environment and identity configuration. Umbraco Cloud sites run under low-privilege, isolated Azure App Service worker identities,…
Recommended action: Upgrade to 13.12.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The information available is limited but would perhaps give some additional detail useful for someone attempting to brute force derive a user's password. The vulnerability can be found in the supported Umbraco versions 10 and 13. It was not exposed in Umbraco 7 or 8, nor in 14 or higher versions. Patches Patched in 10.8.11 and 13.9.2
Recommended action: Upgrade to 13.9.2 or 10.8.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Via a manipulated API request it's possible to upload a file that doesn't adhere with the configured allowable file extensions. Patches Patched in 15.4.2 and 16.0.0. Workarounds None available.
Recommended action: Upgrade to 15.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. Patches Patched in 10.8.10 and 13.8.1. Workarounds None available.
Recommended action: Upgrade to 13.8.1 or 10.8.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. Patches The issue affects Umbraco 14+ and is patched in 14.3.4 and 15.3.1. Workarounds Umbraco supports the configuration of allowed and disallowed file extensions. Using these options to allow only necessary file extensions significantly reduces the scope of the vulnerability.
Recommended action: Upgrade to 15.3.1 or 14.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Authenticated users are able to exploit an XSS vulnerability when viewing previewed content. Patches Will be patched in 10.8.8, 13.5.3, 14.3.2 and 15.1.2. Workarounds None available.
Recommended action: Upgrade to 15.1.2, 14.3.2, 13.5.3 or 10.8.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Based on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists. Patches Patched in 14.3.2 and 15.1.2. Workarounds None available.
Recommended action: Upgrade to 15.1.2 or 14.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact During an explicit sign-out, the server session is not fully terminated.
Recommended action: Upgrade to 13.5.2 or 10.8.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact There is a potential risk of code execution for Backoffice users when they “preview” SVG files in full screen mode. Workarounds Server-side file validation is available to strip script tags from file's content during the file upload process.
Recommended action: Upgrade to 13.5.2 or 10.8.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are.
Recommended action: Upgrade to 13.5.2 or 10.8.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An improper access control issue has been identified, allowing low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to the settings section
Recommended action: Upgrade to 14.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact As an authenticated user one can access a few unintended endpoints Explanation of the vulnerability Few endpoints in Umbraco Management API was not protected by a specific section. These just required you to be authenticated. Due to the fact that a member is also just authenticated, it was possible to get info from these endpoints using a member token.
Recommended action: Upgrade to 14.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
12.2.010.7.07.15.118.18.911.5.0· Vendor fix available
Issue
Impact A user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Workaround Implement the server side file validation https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation or Serve all media from an different host (e.g cdn) that where umbraco is hosted
Recommended action: Upgrade to 12.2.0, 11.5.0, 10.7.0 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A brute force exploit that can be used to collect valid usernames is possible. Explanation of the vulnerability It's a brute force exploit that can be used to collect valid usernames by using the “forgot password” function when trying to log into the Backoffice. If the username/email is known, it is easier to find the corresponding password. If an email address that was already used and registered by a user, is provided as an input, the server internal processing time takes longer. If the email address does not exist in the database of the registered users, the server would respond immediately.
Recommended action: Upgrade to 12.3.4, 10.8.1 or 8.18.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled Explanation of the vulnerability Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but do not response.
Recommended action: Upgrade to 12.3.4, 10.8.1 or 8.18.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users with low privileges ( Editor, etc) are able to access some unintended endpoints. Explanation of the vulnerability Possible to delete redirect urls, when disabled by admin with only access to backoffice Possible to access the examine dashboard with only access to backoffice Possible to access the published cache dashboard with only access to backoffice Possible to access the telemetry dashboard with only access to backoffice Possible to access the languages with only access to backoffice Possible to access the stylesheets with only access to backoffice
Recommended action: Upgrade to 12.3.4, 10.8.1 or 8.18.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Backoffice users with permissions to create packages can use path traversal and thereby write outside of the expected location. Explanation of the vulnerability The “Package” section in Umbraco Backoffice allows a logged in user to write folders outside of the default package directory.
Recommended action: Upgrade to 12.3.4, 10.8.1 or 8.18.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Cross-site scripting (XSS) enable attackers to bring malicious content into a website or application. Explanation of the vulnerability A DOM-XSS can be exploited when users are successfully logging into the Backoffice.
Recommended action: Upgrade to 12.3.4 or 10.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request body of the "Send for Approval" request.
Recommended action: Upgrade to 12.3.0, 10.8.0 or 8.18.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A user with access to a specific part of the backoffice is able to inject HTML code into a form where it is not intended. Explanation of the vulnerability A person with access to the backoffice and the "users" section could send a user invite and inject HTML code into the invite message.
Recommended action: Upgrade to 12.1.0, 10.7.0 or 8.18.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.