{"schema":"threatline.record/2","record":{"id":"CVE-2026-117553","aliases":["GHSA-rpv9-qp4c-g469"],"summary":"Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning","details":"Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.","categories":["Unclassified"],"product":"Umbraco-CMS","vendor":"umbraco","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117553","source_modified_at":"2026-10-27T13:07:49.671Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"Umbraco-CMS","vendor":"umbraco","versions":[{"status":"affected","version":"0","lessThan":"17.7.2","versionType":"semver"},{"status":"affected","version":"18.0.0","lessThan":"18.2.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117553","source_modified_at":"2026-10-27T13:07:49.671Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"Umbraco-CMS","ecosystem":null},"version":"17.7.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117553","source_modified_at":"2026-10-27T13:07:49.671Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"Umbraco-CMS","ecosystem":null},"version":"18.2.2","basis":"first unaffected version stated in the CVE record"}],"cvss":7.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T13:07:49.671Z","modified_at":"2026-10-27T13:07:49.671Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117553","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:07:49.671Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/umbraco/Umbraco-CMS/commit/490b9b27dcbb8fb3fe868a36203590968b0569d6","tags":["patch"]},{"source":"CVE List","url":"https://github.com/umbraco/Umbraco-CMS","tags":["product"]},{"source":"CVE List","url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rpv9-qp4c-g469","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.1/src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs#L74-L112","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.2-and-18.2.2-account-takeover-via-host-header-poisoning","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T13:07:49.671Z","content_hash":"21f88ba4cb1666de98d06777210617b9c986de9ba14573bfa4b09b4677fc0718"}}