Missing Authorization in Umbraco CMS - #VU158819
Published: November 3, 2026
Vulnerability identifier: #VU158819
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to retrieve media file URLs and download files outside their permitted media start nodes.
The vulnerability exists due to missing authorization checks in the Umbraco CMS Management API media URL resolution endpoints when resolving media outside the requesting user's start nodes. A remote user can request the URL of a media item outside their permitted scope and use the returned static file URL to download the file.
Exploitation requires prior knowledge of the targeted item's identifier.
Affected software
Umbraco CMS
Remediation
Install security update from vendor's website.
Umbraco CMS - addressed in versions 17.7.2, 18.2.2