Read the docs
TI-2023-26909 Aliases CVE-2023-49273GHSA-cfr5-7p54-4qg8

Umbraco CMS vulnerable to Privilege Escalation using Spoofing

Priority LOW 25CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

Why it matters now

EPSS 0.00369 30th percentileScored 2026-11-07
Fix Fixed Umbraco-CMS (umbraco): 8.18.10, 10.8.1, 12.3.4Umbraco.CMS (NuGet): 8.18.10, 10.8.1, 12.3.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
umbracoUmbraco-CMS8.0.0 to before 8.18.10; 9.0.0-rc001 to before 10.8.1; 11.0.0-rc1 to before 12.3.48.18.10, 10.8.1, 12.3.4Patch availableCNA
—Umbraco.CMS (NuGet)8.0.0 to before 8.18.108.18.10Patch availableGHSA-cfr5-7p54-4qg8
—Umbraco.CMS (NuGet)9.0.0 to before 10.8.110.8.1Patch availableGHSA-cfr5-7p54-4qg8
—Umbraco.CMS (NuGet)11.0.0 to before 12.3.412.3.4Patch availableGHSA-cfr5-7p54-4qg8
  • Umbraco-CMS Vendorumbraco Affected 8.0.0 to before 8.18.10; 9.0.0-rc001 to before 10.8.1; 11.0.0-rc1 to before 12.3.4 Fixed in 8.18.10, 10.8.1, 12.3.4 Patch available CNA
  • Umbraco.CMS (NuGet) Vendor— Affected 8.0.0 to before 8.18.10 Fixed in 8.18.10 Patch available GHSA-cfr5-7p54-4qg8
  • Umbraco.CMS (NuGet) Vendor— Affected 9.0.0 to before 10.8.1 Fixed in 10.8.1 Patch available GHSA-cfr5-7p54-4qg8
  • Umbraco.CMS (NuGet) Vendor— Affected 11.0.0 to before 12.3.4 Fixed in 12.3.4 Patch available GHSA-cfr5-7p54-4qg8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*8.0.0 to before 8.18.10; 10.0.0 to before 10.8.1; 12.0.0 to before 12.3.4Vulnerableumbraco
  • cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.18.10; 10.0.0 to before 10.8.1; 12.0.0 to before 12.3.4 Vulnerable ·umbraco

Remediation

  • Fix · CNA Umbraco-CMS (umbraco) Fixed in 8.18.10, 10.8.1, 12.3.4
  • Fix · GHSA-cfr5-7p54-4qg8 Umbraco.CMS (NuGet) Fixed in 8.18.10 Advisory →
  • Fix · GHSA-cfr5-7p54-4qg8 Umbraco.CMS (NuGet) Fixed in 10.8.1 Advisory →
  • Fix · GHSA-cfr5-7p54-4qg8 Umbraco.CMS (NuGet) Fixed in 12.3.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49273
  2. 2026-10-03 Alias added: GHSA-cfr5-7p54-4qg8

References

Advisory 2

Other 1

  • TI-2025-41183 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… CVSS 3.1CRITICAL 10.0
  • TI-2012-05477 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVSS 4.0CRITICAL 9.3
  • TI-2021-22392 Umbraco v8.14.1 - 'baseUrl' SSRF CVSS 4.0MEDIUM 6.9
  • TI-2024-36846 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers… CVSS 3.1MEDIUM 6.5
  • TI-2019-15240 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by… CVSS 3.1HIGH 7.2
  • TI-2020-04738 Cross-site scripting in Umbraco CMS CVSS 3.1MEDIUM 5.4
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences