Incorrect authorization in Umbraco CMS - #VU158826
Published: November 3, 2026
Vulnerability identifier: #VU158826
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to escalate privileges and gain unauthorized read and modification access to content and media outside their assigned start nodes.
The vulnerability exists due to incorrect authorization in Umbraco CMS user group start node validation when processing group creation or update requests with "Allow access to all documents" or "Allow access to all media" selected. A remote privileged user can create or edit a user group through the Users section to grant access beyond their own permitted content or media tree, including escalating their own access by editing their own group.
Affected software
Umbraco CMS
Remediation
Install security update from vendor's website.
Umbraco CMS - addressed in versions 13.16.3, 17.7.2, 18.2.2