CVE-2026-69197: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in umbraco Umbraco-CMS
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.
AI Analysis
Technical Summary
CVE-2026-69197 describes an information exposure vulnerability in Umbraco CMS's Content Delivery API. The API enforces member and Public Access checks on directly requested nodes but fails to enforce these checks on referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including those nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, anonymous users can retrieve protected node metadata and expanded property values via referencing nodes. Similarly, API key holders can bypass per-node Public Access restrictions through the same expansion mechanism. This bypass also circumvents content-type alias restrictions. Direct requests to protected nodes remain properly restricted with 401 responses. The vulnerability does not affect integrity or availability. It is resolved in Umbraco CMS versions 13.15.1, 17.5.3, and 18.0.2.
Potential Impact
Unauthorized actors, including anonymous users or API key holders, can access sensitive metadata and property values of protected content nodes that should be restricted. This leads to exposure of sensitive information without proper authorization. There is no impact on data integrity or system availability. The exposure could potentially aid attackers in reconnaissance or unauthorized data access.
Mitigation Recommendations
This vulnerability is fixed in Umbraco CMS versions 13.15.1, 17.5.3, and 18.0.2. Users should upgrade to one of these versions or later to remediate the issue. No additional mitigation steps are indicated beyond applying the official patches.
CVE-2026-69197: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in umbraco Umbraco-CMS
Description
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.
CVSS v4.0
Score 8.7high
Affected software
umbraco
Umbraco-CMS
pkg:nuget/umbraco-cmsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-69197 describes an information exposure vulnerability in Umbraco CMS's Content Delivery API. The API enforces member and Public Access checks on directly requested nodes but fails to enforce these checks on referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including those nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, anonymous users can retrieve protected node metadata and expanded property values via referencing nodes. Similarly, API key holders can bypass per-node Public Access restrictions through the same expansion mechanism. This bypass also circumvents content-type alias restrictions. Direct requests to protected nodes remain properly restricted with 401 responses. The vulnerability does not affect integrity or availability. It is resolved in Umbraco CMS versions 13.15.1, 17.5.3, and 18.0.2.
Potential Impact
Unauthorized actors, including anonymous users or API key holders, can access sensitive metadata and property values of protected content nodes that should be restricted. This leads to exposure of sensitive information without proper authorization. There is no impact on data integrity or system availability. The exposure could potentially aid attackers in reconnaissance or unauthorized data access.
Mitigation Recommendations
This vulnerability is fixed in Umbraco CMS versions 13.15.1, 17.5.3, and 18.0.2. Users should upgrade to one of these versions or later to remediate the issue. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-03T16:00:23.483Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aac242c55bf5e2cf5ad8ff5
Added to database: 09/17/2026, 17:32:28 UTC
Last enriched: 09/17/2026, 17:46:51 UTC
Last updated: 09/18/2026, 00:31:04 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.