Missing Authorization in Umbraco CMS - #VU158820
Published: November 3, 2026
Vulnerability identifier: #VU158820
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose the names, publish states and types of items referencing documents, media items or elements outside their permitted start nodes.
The vulnerability exists due to missing authorization checks in the Umbraco CMS Management API reference lookups when handling requests for items outside the requesting user's content, media or element start nodes. A remote user can submit a reference lookup for an out-of-scope item to retrieve metadata about the items that reference it.
Exploitation requires prior knowledge of the targeted item's identifier. Reference lookups do not expose property values or allow changes.
Affected software
Umbraco CMS
Remediation
Install security update from vendor's website.
Umbraco CMS - addressed in versions 17.7.2, 18.2.2