Umbraco vulnerabilities
52 CVEs and advisories name Umbraco as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-117553Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
- CVE-2026-111624Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
- CVE-2026-69197Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
- CVE-2026-46609Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
- CVE-2026-46616Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
- CVE-2026-31834Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
- CVE-2026-31833Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
- CVE-2026-31832Umbraco Backoffice API Allows Unauthorized Modification of Domain Data
- CVE-2026-27449Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints
- CVE-2026-24687Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
- CVE-2025-68924In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for rem
- CVE-2021-47776Umbraco v8.14.1 - 'baseUrl' SSRF
- CVE-2025-66625Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import Functionality
- CVE-2012-10054Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
- CVE-2025-54425Umbraco's Delivery API allows for cached requests to be returned with an invalid API key
- CVE-2025-49147Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements
- CVE-2025-48953Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
- CVE-2025-47280Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
- CVE-2025-46736Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
- CVE-2025-32017Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
- CVE-2025-27602Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
- CVE-2025-27601Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
- CVE-2025-24012Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability
- CVE-2025-24011Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
- CVE-2025-23041Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms
- CVE-2024-10761Umbraco CMS Dashboard frame cross site scripting
- CVE-2024-48929Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
- CVE-2024-48927Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
- CVE-2024-48926Umbraco CMS logout page displayed before session expiration
- CVE-2024-48925Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API