Umbraco vulnerabilities
3 known CVE vulnerabilities in Umbraco, translated and rated.
- CVE-2026-69197High
Umbraco prior to 13.15.1, 17.5.3, and 18.0.2, in the Content Delivery API, applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values.
- CVE-2015-8814High
Umbraco before version 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks, as demonstrated by editing user account information in the templates.asmx.cs file.
- CVE-2012-1301Critical
The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the 'url' parameter.