CVE-2026-117553GHSA-rpv9-qp4c-g469
Umbraco-CMS: Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
umbraco Umbraco-CMS
CVSS
7.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
Text from CVE List
Affected versions 2
- Umbraco-CMSaffected: all versions before 17.7.2CVE List
- Umbraco-CMSaffected: 18.0.0 before 18.2.2CVE List
References 5
- github.com/umbraco/Umbraco-CMS/commit/490b9b27dcbb8fb3fe868a36203590968b0569d6Fixvia CVE List
- github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rpv9-qp4c-g469Advisoryvia CVE List
- vulncheck.com/advisories/umbraco-cms-before-17.7.2-and-18.2.2-account-takeover-via-host-header-poisoningAdvisoryvia CVE List
- github.com/umbraco/Umbraco-CMSReferencevia CVE List
- github.com/umbraco/Umbraco-CMS/blob/release-18.2.1/src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs#L74-L112Referencevia CVE List