Insufficient Session Expiration in Umbraco CMS - #VU158816
Published: November 3, 2026
Vulnerability identifier: #VU158816
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to view unpublished website content accessible through another user's preview session without a time limit.
The vulnerability exists due to insufficient session expiration in the Umbraco CMS website preview feature when validating preview tokens. A remote attacker can obtain and reuse a user's preview token to view unpublished content available to that user indefinitely, even after the user's password changes, provided the account remains enabled, unlocked and undeleted.
On sites protected by basic authentication, a copied preview token also bypasses that protection.
Affected software
Umbraco CMS
Remediation
Install security update from vendor's website.
Umbraco CMS - addressed in versions 17.7.2, 18.2.2