SB2026110352 - Multiple vulnerabilities in Umbraco CMS

Main Vulnerability Database SB2026110352

SB2026110352 - Multiple vulnerabilities in Umbraco CMS

Published: November 3, 2026

Security Bulletin ID SB2026110352

CSH Severity

High

Patch available

YES

Number of vulnerabilities 12

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 12 vulnerabilities.

1) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to view unpublished website content accessible through another user's preview session without a time limit.

The vulnerability exists due to insufficient session expiration in the Umbraco CMS website preview feature when validating preview tokens. A remote attacker can obtain and reuse a user's preview token to view unpublished content available to that user indefinitely, even after the user's password changes, provided the account remains enabled, unlocked and undeleted.

On sites protected by basic authentication, a copied preview token also bypasses that protection.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to view unpublished content outside their permitted content scope.

The vulnerability exists due to improper authorization in Umbraco CMS website preview when displaying unpublished content outside a user's start nodes or browse permissions. A remote user can use website preview after opening it at least once to view restricted drafts directly or through references from accessible pages.

In Umbraco 18, the issue also affects library elements outside the user's element start nodes.

3) Insertion of Sensitive Information Into Sent Data (CVE-ID: N/A)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to expose unpublished document names through Delivery API responses.

The vulnerability exists due to inclusion of sensitive information in Delivery API responses in Umbraco CMS when website preview state affects requests to the enabled Delivery API. A remote user can make a Delivery API request from the same browser after using backoffice preview to cause unpublished names of documents linked from published content to appear in API responses.

For a period after the triggering request, the unpublished names can also be returned to other API callers, including anonymous callers.

4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to retrieve media file URLs and download files outside their permitted media start nodes.

The vulnerability exists due to missing authorization checks in the Umbraco CMS Management API media URL resolution endpoints when resolving media outside the requesting user's start nodes. A remote user can request the URL of a media item outside their permitted scope and use the returned static file URL to download the file.

Exploitation requires prior knowledge of the targeted item's identifier.

5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose the names, publish states and types of items referencing documents, media items or elements outside their permitted start nodes.

The vulnerability exists due to missing authorization checks in the Umbraco CMS Management API reference lookups when handling requests for items outside the requesting user's content, media or element start nodes. A remote user can submit a reference lookup for an out-of-scope item to retrieve metadata about the items that reference it.

Exploitation requires prior knowledge of the targeted item's identifier. Reference lookups do not expose property values or allow changes.

6) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose relation listings without the required access to the Settings section.

The vulnerability exists due to incorrect authorization in the Umbraco CMS Management API relation-type listing endpoint when checking section access permissions. A remote user can use access to the Content section to list the relations of a relation type despite lacking access to the Settings section.

7) Open redirect (CVE-ID: CVE-2026-117553)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to take over a back-office account and, if the victim is an administrator, gain full control of the back-office and potentially execute code on the server.

The vulnerability exists due to insufficient validation of redirect destinations and inadequate handling of sign-in codes in the Umbraco CMS back-office sign-in flow when processing sign-in requests. A remote attacker can manipulate sign-in redirects and trick a signed-in back-office user into opening a crafted link to obtain an authenticated session with that user's privileges.

The full attack chain requires a web server or hosting setup that passes requests for unrecognised host names through to Umbraco.

8) Insufficient Session Expiration (CVE-ID: N/A)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to retain unauthorized access to the Umbraco backoffice after a user signs out.

The vulnerability exists due to insufficient session expiration in the Umbraco backoffice logout functionality when processing a sign-out request. A remote attacker can reuse a previously obtained backoffice authentication cookie (UMB_UCONTEXT*) until it expires to access backoffice information and perform actions with the signed-out user's permissions.

9) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute stored scripts in another back-office user's browser context, potentially reading or changing content and configuration accessible to that user.

The vulnerability exists due to improper neutralization of stored media file information in the Umbraco CMS back-office when displaying media items. A remote user can save malicious file information using an account with permission to update media and induce another back-office user to interact with the affected item to execute scripts with that user's privileges.

10) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass intended path restrictions as part of a chain that executes stored scripts in another back-office user's browser context.

The vulnerability exists due to improper restriction of pathnames in Umbraco CMS media management when handling media file information. A remote user can supply a crafted path through media updates and chain path traversal with stored cross-site scripting to execute scripts with the privileges of another back-office user who interacts with the affected media item.

11) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to escalate privileges and gain unauthorized read and modification access to content and media outside their assigned start nodes.

The vulnerability exists due to incorrect authorization in Umbraco CMS user group start node validation when processing group creation or update requests with "Allow access to all documents" or "Allow access to all media" selected. A remote privileged user can create or edit a user group through the Users section to grant access beyond their own permitted content or media tree, including escalating their own access by editing their own group.

12) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to escalate privileges and gain unauthorized read and modification access to elements outside their assigned start nodes.

The vulnerability exists due to missing authorization checks in Umbraco CMS Elements start node assignment when processing user or user group creation or update requests. A remote privileged user can use the Users section to assign an element start node outside their own permitted start nodes, granting themselves or managed users access to elements beyond their intended restrictions.

Remediation

Install update from vendor's website.

References