CVE-2026-69197
unknown
CVSS v3
—
CVSS v4 NEW
8.7
VIR risk
—
Description
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| NuGet | Umbraco.Cms | >=12.0.0,<13.15.1 | 13.15.1 |
| NuGet | Umbraco.Cms | >=14.0.0-rc1,<17.5.3 | 17.5.3 |
| NuGet | Umbraco.Cms | >=18.0.0,<18.0.2 | 18.0.2 |
References
- https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe
- https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511
- https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015
- https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1
- https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3
- https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh
- https://github.com/umbraco/Umbraco-CMS
CWEs
CWE-200 CWE-862
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.