Incorrect authorization in Umbraco CMS - #VU158817
Published: November 3, 2026
Vulnerability identifier: #VU158817
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to view unpublished content outside their permitted content scope.
The vulnerability exists due to improper authorization in Umbraco CMS website preview when displaying unpublished content outside a user's start nodes or browse permissions. A remote user can use website preview after opening it at least once to view restricted drafts directly or through references from accessible pages.
In Umbraco 18, the issue also affects library elements outside the user's element start nodes.
Affected software
Umbraco CMS
Remediation
Install security update from vendor's website.
Umbraco CMS - addressed in versions 17.7.2, 18.2.2