PT-2026-24487 · Umbraco+1 · Umbraco+1

Odgrso · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-31834

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Umbraco versions 15.3.1 through 16.5.0 Umbraco version 17.2.2

Description Umbraco CMS contains a privilege escalation issue. Authenticated backoffice users with user management permissions may be able to gain elevated privileges due to inadequate authorization checks when modifying user group memberships. The system does not properly verify if a user is authorized to assign highly privileged roles.

Recommendations Update to Umbraco version 16.5.1 or later. Update to Umbraco version 17.2.2 or later.

Exploit

Fix

LPE

Improper Access Control

Improper Privilege Management

Missing Authorization

Weakness Enumeration

CWE-284

CWE-269

CWE-862

Related Identifiers

CVE-2026-31834

GHSA-RHCG-3H8R-V6VP

Affected Products

Umbraco

Umbraco Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31834.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31834 · Security Note
• https://osv.dev/vulnerability/GHSA-rhcg-3h8r-v6vp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31834 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://t.me/CVEtracker/47039 · Telegram Post
• https://twitter.com/dailycve/status/2031907598107107612 · Twitter Post
• https://twitter.com/CVEnew/status/2031504062546317783 · Twitter Post