Read the docs
TI-2026-48542 Aliases CVE-2026-69197GHSA-wr57-hqmp-fgvh

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Priority MEDIUM 45CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-862.

Summary

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00662 51st percentileScored 2026-11-07
Fix Fixed Umbraco-CMS (umbraco): 13.15.1, 17.5.3, 18.0.2Umbraco.Cms (NuGet): 13.15.1, 17.5.3, 18.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
umbracoUmbraco-CMS12.0.0 to before 13.15.1; 14.0.0-rc1 to before 17.5.3; 18.0.0 to before 18.0.213.15.1, 17.5.3, 18.0.2Patch availableCNA
—Umbraco.Cms (NuGet)12.0.0 to before 13.15.113.15.1Patch availableGHSA-wr57-hqmp-fgvh
—Umbraco.Cms (NuGet)14.0.0-rc1 to before 17.5.317.5.3Patch availableGHSA-wr57-hqmp-fgvh
—Umbraco.Cms (NuGet)18.0.0 to before 18.0.218.0.2Patch availableGHSA-wr57-hqmp-fgvh
  • Umbraco-CMS Vendorumbraco Affected 12.0.0 to before 13.15.1; 14.0.0-rc1 to before 17.5.3; 18.0.0 to before 18.0.2 Fixed in 13.15.1, 17.5.3, 18.0.2 Patch available CNA
  • Umbraco.Cms (NuGet) Vendor— Affected 12.0.0 to before 13.15.1 Fixed in 13.15.1 Patch available GHSA-wr57-hqmp-fgvh
  • Umbraco.Cms (NuGet) Vendor— Affected 14.0.0-rc1 to before 17.5.3 Fixed in 17.5.3 Patch available GHSA-wr57-hqmp-fgvh
  • Umbraco.Cms (NuGet) Vendor— Affected 18.0.0 to before 18.0.2 Fixed in 18.0.2 Patch available GHSA-wr57-hqmp-fgvh

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*——umbraco
  • cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:* Versions — — ·umbraco

Remediation

  • Fix · CNA Umbraco-CMS (umbraco) Fixed in 13.15.1, 17.5.3, 18.0.2
  • Fix · GHSA-wr57-hqmp-fgvh Umbraco.Cms (NuGet) Fixed in 13.15.1 Advisory →
  • Fix · GHSA-wr57-hqmp-fgvh Umbraco.Cms (NuGet) Fixed in 17.5.3 Advisory →
  • Fix · GHSA-wr57-hqmp-fgvh Umbraco.Cms (NuGet) Fixed in 18.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69197
  2. 2026-10-03 Alias added: GHSA-wr57-hqmp-fgvh
  3. 2026-10-06 EPSS moved to the 50th–90th percentile

References

Other 8

  • TI-2025-41183 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… CVSS 3.1CRITICAL 10.0
  • TI-2012-05477 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVSS 4.0CRITICAL 9.3
  • TI-2021-22392 Umbraco v8.14.1 - 'baseUrl' SSRF CVSS 4.0MEDIUM 6.9
  • TI-2024-36846 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers… CVSS 3.1MEDIUM 6.5
  • TI-2019-15240 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by… CVSS 3.1HIGH 7.2
  • TI-2020-04738 Cross-site scripting in Umbraco CMS CVSS 3.1MEDIUM 5.4
See all 75 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences