This vulnerability involves stored XSS in Umbraco CMS v14.3.1, enabling attackers to inject malicious scripts or HTML that persist in the application. The vendor has disputed the classification of this issue as a vulnerability, citing that exploitation is limited to authenticated users who have been explicitly granted CMS access and that the lack of HTML sanitization is a deliberate design choice. There is no vendor advisory or patch available at this time.

The impact is limited to the confidentiality and integrity of data accessible by authenticated users with CMS access. There is no indication of availability impact or exploitation by unauthenticated users. Since the vulnerability requires manual granting of access and no patch is provided, the risk is constrained to trusted users misusing their privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor disputes this as a vulnerability and has made a deliberate design decision not to sanitize HTML, no official fix is currently available. Organizations should carefully control and audit user access to the CMS to mitigate risk.