Incorrect authorization in Umbraco CMS - #VU158827
Published: November 3, 2026
Vulnerability identifier: #VU158827
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to escalate privileges and gain unauthorized read and modification access to elements outside their assigned start nodes.
The vulnerability exists due to missing authorization checks in Umbraco CMS Elements start node assignment when processing user or user group creation or update requests. A remote privileged user can use the Users section to assign an element start node outside their own permitted start nodes, granting themselves or managed users access to elements beyond their intended restrictions.
Affected software
Umbraco CMS
Remediation
Install security update from vendor's website.
Umbraco CMS - addressed in versions 13.16.3, 17.7.2, 18.2.2