CVE-2023-37267
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Umbraco, an ASP.NET CMS, can under rare conditions allow unauthorized users access to admin-level permissions after a restart. This vulnerability was patched in versions 10.6.1, 11.4.2, and 12.0.1.
Risk Assessment
Access to admin-level permissions by unauthorized users could lead to serious security breaches and data loss within the organization.
Recommendation
It is recommended to update Umbraco to the latest version to mitigate this vulnerability and to monitor access to the system.
Other vulnerabilities in Umbraco CMS
See all- CVE-2025-67288Critical
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. The supplier disputes this, stating that file validation is the administrator's responsibility and that PDF JavaScript runs in an isolated sandbox.
- CVE-2026-46616Medium
Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some Surface Controllers in the CMS fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks.
- CVE-2024-55488Medium
A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.
Original NVD description (English source)
Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.