CVE-2026-46616 is an open redirect vulnerability (CWE-601) affecting Umbraco CMS. Specifically, some Surface Controllers used for member-related operations do not validate redirect URLs properly when these URLs are derived from user-controlled query parameters in Razor templates. This flaw allows attackers to craft URLs that redirect users to untrusted external sites. The vulnerability affects versions prior to 13.14.0 and versions from 17.3.0-rc up to but excluding 17.4.0. The issue has been addressed and patched in versions 13.14.0 and 17.4.0.

Successful exploitation could lead to users being redirected to malicious external websites, potentially facilitating phishing or other social engineering attacks. The vulnerability impacts confidentiality and integrity to a limited extent by enabling user redirection but does not affect availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Upgrade affected Umbraco CMS installations to version 13.14.0 or later, or to version 17.4.0 or later, where this vulnerability has been fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the issue is resolved in these versions.