Insertion of Sensitive Information Into Sent Data in Umbraco CMS - #VU158818
Published: November 3, 2026
Vulnerability identifier: #VU158818
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to expose unpublished document names through Delivery API responses.
The vulnerability exists due to inclusion of sensitive information in Delivery API responses in Umbraco CMS when website preview state affects requests to the enabled Delivery API. A remote user can make a Delivery API request from the same browser after using backoffice preview to cause unpublished names of documents linked from published content to appear in API responses.
For a period after the triggering request, the unpublished names can also be returned to other API callers, including anonymous callers.
Affected software
Umbraco CMS
Remediation
Install security update from vendor's website.
Umbraco CMS - addressed in versions 17.7.2, 18.2.2