TI-2026-81157 Aliases CVE-2026-117553 GHSA-r8f2-fxjr-gx5r

Host header poisoning in Umbraco CMS enables account takeover

LOW 36CWE-601Published 2026-10-27 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

Umbraco-CMS from 0 before 17.7.2 and from 18.0.0 before 18.2.2 is affected. An authentication bypass lets unauthenticated remote attackers register attacker-controlled OAuth redirect URIs by poisoning the Host header, which is a form of URL redirection to an untrusted site (CWE-601). Attackers lure signed-in users into authorization links that capture codes, then use those codes to hijack back-office sessions and execute code through Razor templates.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00495 42nd percentileScored 2026-11-07

Fix Fixed Umbraco-CMS (umbraco): 17.7.2, 18.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
umbraco	Umbraco-CMS	before 17.7.2; 18.0.0 to before 18.2.2	17.7.2, 18.2.2	Patch available	CNA

Umbraco-CMS Vendorumbraco Affected before 17.7.2; 18.0.0 to before 18.2.2 Fixed in 17.7.2, 18.2.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:umbraco:umbraco_cms::::::::	—	—	umbraco

cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:* Versions — — ·umbraco

Remediation

Upgrade Umbraco-CMS 17 releases to 17.7.2 and 18 releases to 18.2.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA Umbraco-CMS (umbraco) Fixed in 17.7.2, 18.2.2

Timeline

2026-10-27 Threatist record created from CVE-2026-117553
2026-10-27 Alias added: GHSA-r8f2-fxjr-gx5r
2026-10-28 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed

References

Patch 1

Patch Commit

Advisory 1

GitHub Security Advisory (GHSA-rpv9-qp4c-g469)

Other 2

TI-2025-41183 An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute… CVSS 3.1CRITICAL 10.0
TI-2012-05477 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE CVSS 4.0CRITICAL 9.3
TI-2021-22392 Umbraco v8.14.1 - 'baseUrl' SSRF CVSS 4.0MEDIUM 6.9
TI-2024-36846 A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers… CVSS 3.1MEDIUM 6.5
TI-2019-15240 Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by… CVSS 3.1HIGH 7.2
TI-2020-04738 Cross-site scripting in Umbraco CMS CVSS 3.1MEDIUM 5.4

See all 75 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences