CVE-2026-117553
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
Risk Assessment
An attacker can hijack back-office sessions and execute arbitrary code in the application context, leading to full CMS compromise.
Recommendation
Update Umbraco CMS to version 17.7.2 or 18.2.2 (or later). Verify Host header configuration and restrict trusted hosts.
Other vulnerabilities in Umbraco CMS
See all- CVE-2025-67288Critical
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. The supplier disputes this, stating that file validation is the administrator's responsibility and that PDF JavaScript runs in an isolated sandbox.
- CVE-2026-111624Low
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
- CVE-2026-46616Medium
Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some Surface Controllers in the CMS fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks.
- CVE-2021-47776Medium
A server-side request forgery vulnerability was found in Umbraco CMS v8.14.1. Attackers can manipulate baseUrl parameters in multiple dashboard and help controller endpoints, such as GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss, to trigger unauthorized server-side requests to external hosts.
- CVE-2024-55488Medium
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.
- CVE-2023-37267High
Umbraco, an ASP.NET CMS, can under rare conditions allow unauthorized users access to admin-level permissions after a restart. This vulnerability was patched in versions 10.6.1, 11.4.2, and 12.0.1.
Original NVD description (English source)
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS