CVE-2026-69197 (GCVE-0-2026-69197)
Vulnerability from cvelistv5
Published
2026-09-17 15:44
Modified
2026-09-17 17:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.
References
| URL | Tags | |
|---|---|---|
|
|
||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| umbraco | Umbraco-CMS |
Version: >= 12.0.0, < 13.15.1 Version: >= 14.0.0-rc1, < 17.5.3 Version: >= 18.0.0, < 18.0.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:23:00.299716Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:23:18.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Umbraco-CMS",
"vendor": "umbraco",
"versions": [
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 13.15.1"
},
{
"status": "affected",
"version": "\u003e= 14.0.0-rc1, \u003c 17.5.3"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node\u0027s name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:44:24.988Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh"
},
{
"name": "https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe"
},
{
"name": "https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511"
},
{
"name": "https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015"
},
{
"name": "https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1"
},
{
"name": "https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3"
},
{
"name": "https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2"
}
],
"source": {
"advisory": "GHSA-wr57-hqmp-fgvh",
"discovery": "UNKNOWN"
},
"title": "Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-69197",
"datePublished": "2026-09-17T15:44:24.988Z",
"dateReserved": "2026-08-03T16:00:23.483Z",
"dateUpdated": "2026-09-17T17:23:18.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-200\", \"lang\": \"en\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-862\", \"lang\": \"en\", \"description\": \"CWE-862: Missing Authorization\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 8.7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh\"}, {\"name\": \"https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe\"}, {\"name\": \"https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511\"}, {\"name\": \"https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015\"}, {\"name\": \"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1\"}, {\"name\": \"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3\"}, {\"name\": \"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2\"}], \"affected\": [{\"vendor\": \"umbraco\", \"product\": \"Umbraco-CMS\", \"versions\": [{\"version\": \"\u003e= 12.0.0, \u003c 13.15.1\", \"status\": \"affected\"}, {\"version\": \"\u003e= 14.0.0-rc1, \u003c 17.5.3\", \"status\": \"affected\"}, {\"version\": \"\u003e= 18.0.0, \u003c 18.0.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-17T15:44:24.988Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node\u0027s name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.\"}], \"source\": {\"advisory\": \"GHSA-wr57-hqmp-fgvh\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-69197\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-17T17:23:00.299716Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-17T17:23:05.991Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-69197\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-08-03T16:00:23.483Z\", \"datePublished\": \"2026-09-17T15:44:24.988Z\", \"dateUpdated\": \"2026-09-17T17:23:18.418Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…