PT-2026-24485 · Umbraco · Umbraco

Odgrso · Publicado 2026-03-10 · Atualizado 2026-03-11 · CVE-2026-31832

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Umbraco versions 14.0.0 through 16.5.0 Umbraco version 17.2.2

Description Umbraco, an ASP.NET CMS, contains a flaw in a backoffice API endpoint related to object-level authorization. Authenticated users can assign domain-related data to content nodes without sufficient authorization checks. This occurs because of inadequate authorization enforcement on the API endpoint, allowing users to set domains on content nodes they are not permitted to access, either through user group privileges or start nodes. The vulnerable API endpoint allows this unauthorized assignment. The affected parameters or variables are not specified.

Recommendations Update to Umbraco version 16.5.1 or later. Update to Umbraco version 17.2.2.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-31832

GHSA-FPVF-FVP5-996R

Produtos afetados

Umbraco

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31832.json · Exploit
• https://github.com/umbraco/Umbraco-CMS · Nota
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fpvf-fvp5-996r · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31832 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031504064828092690 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1rqu37b/resumen_diario_de_vulnerabilidades_11032026 · Publicação no Reddit
• https://osv.dev/vulnerability/CVE-2026-31832 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fpvf-fvp5-996r · Aviso do Fabricante
• https://t.me/CVEtracker/47037 · Publicação no Telegram