Umbraco vulnerabilities
We track 11 vulnerabilities in Umbraco products across 4 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Umbraco vulnerabilities
- 7.5 High severity
Umbraco-CMS: URL Redirection to Untrusted Site
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links usin
- 8.7 High severity
Umbraco-CMS: Exposure of Sensitive Information to an Unauthorized Actor
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties,
- 7.2 High severity
Umbraco-CMS: Improper Privilege Management
Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their
- 7.5 High severity
Umbraco.Engage.Forms: Improper Access Control
Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versions 16.2.1 and 17.1.1 where certain API endpoints are exposed without enforcing authentication or authorization checks. The affected endpoin
- 7.5 High severity
Forms: Inclusion of Functionality from Untrusted Control Sphere
In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution.
- 10.0 Critical severity
Umbraco CMS: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belo
- 8.8 High severity
Umbraco-CMS: Relative Path Traversal
Umbraco is a free and open source .NET content management system. Authenticated users to the Umbraco backoffice are able to craft management API request that exploit a path traversal vulnerability to upload files into a incorrect location. The issue affects Um
- 8.7 High severity
Umbraco-CMS: Improper Neutralization of Input During Web Page Generation
Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a u
- 9.8 Critical severity
Umbraco-CMS: Improper Access Control
Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
- 7.4 High severity
Umbraco CMS: Inconsistent Interpretation of HTTP Requests
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server the
- 7.5 High severity
Umbraco CMS: Inconsistent Interpretation of HTTP Requests
Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds