What’s affected?
Umbraco CMS
Affected Product Version Range:
14.0.0 - 14.3.3 (no patch, see below)
15.0.0 - 15.4.3 (no patch, see below)
16.0.0 - 16.5.0 (no patch, see below)
17.0.0 - 17.6.1
18.0.0 - 18.1.0
Not affected: Umbraco 13 and earlier. If you’re running Umbraco 13, this issue does not apply to you.
Umbraco Forms
Affected Product Version Range:
13.0.0 - 13.9.8
17.0.0 - 17.4.7
18.0.0 - 18.0.5
Severity: Moderate
This issue only affects forms that use the “sensitive data” setting on one or more fields. If none of your forms mark fields as sensitive, you are not affected.
Umbraco AI
Unsupported versions can be subject to the vulnerability, but will not receive a patch. We recommend upgrading to a supported major version if you are using the affected features.
If you’re using Umbraco.AI.Agent v1, you can safely upgrade to the Umbraco 17, as only version 17 and 18 will receive fixes.
How to fix the vulnerability
If you're using Umbraco CMS versions 17.6 or 18.1, or Umbraco Forms versions 13.9, 17.4, or 18.0, you are able to upgrade to a new patch version of these releases the way you would normally upgrade.
CMS patched versions: 17.6.2 and 18.1.1.
Forms patched versions: 13.9.9, 17.4.8 and 18.0.6.
Umbraco AI Agent patched versions: 17.1.4 and 18.1.4.
These patches contain code changes only. They include no database migrations, so upgrading leaves your database schema unchanged.
If you have Umbraco.AI.Agent installed, upgrade it to version 17 or 18 through NuGet as you would any other package. Because uploaded files are removed automatically after 24 hours by default, upgrading also brings any past exposure to an end rather than leaving old files reachable.
How do you check which version you are on? Reach out to your technical contact for your Umbraco site with this blog post, and they will be able to take care of the necessary precautions.
If your Umbraco project is hosted on Umbraco Cloud, an automatic upgrade will be rolled out today to fix the vulnerabilities for Forms and CMS - no action needed. If you’re running Umbraco AI on your Cloud project(s), this fix needs to be implemented manually, as it's an add-on to your Umbraco Cloud setup.
If you cannot upgrade immediately
Upgrading is the only complete fix for the high-severity CMS issue. If you are unable to upgrade today, running your site in Production runtime mode removes the remote code execution impact, though the underlying authorization weakness remains present in every mode.
Runtime mode is set through Umbraco:CMS:Runtime:Mode, and defaults to BackofficeDevelopment. Production mode is not a simple toggle: it disables Razor runtime compilation and in-memory ModelsBuilder generation, so it requires your views to be compiled at build or publish time and has several other prerequisites. Switching without meeting them will stop your application from starting. Read the runtime modes documentation before making this change, and test it outside production first.
This mitigation is worth considering regardless of your upgrade timeline, but it is not a substitute for upgrading. It is the only option available to sites on Umbraco 14, 15, or 16, which will not receive a patch.
Upgrading is the only complete fix for the moderate-severity Forms issue. There is no complete configuration-level workaround; upgrading is the recommended action.
Setting PackageOptions:DisableRecordIndexing to true closes the first path only, by disabling the records index. Until you can upgrade, the only reliable mitigation for those is to limit access to the Forms section to users who are also permitted to see sensitive data.
What if I’m on an unsupported version of Umbraco CMS?
Umbraco 14, 15, and 16 are all past End-of-Life and will not receive a patch for this issue. Because all three are Standard-term Support releases, Extended Long-term Support is not available for them either.
If you are running one of these versions, the recommended path is to upgrade to a supported major - Umbraco version 17 (LTS) or Umbraco 18. You can check the support status of your version on our Long-term Support and End-of-Life page. Feel free to book a discovery call with us to talk about your options.
What we know about the vulnerability
Umbraco CMS: privilege escalation in the Management API, leading to remote code execution
An authorization flaw in the Umbraco backoffice Management API allowed an authenticated user holding a low-privilege, non-administrative account to carry out a subset of operations that should have been restricted to higher-privileged users. Under the default runtime configuration, this can lead to remote code execution in the context of the web application, and potentially to full compromise of the site and the server hosting it.
Running the application in Production runtime mode mitigates the code execution impact, although the underlying authorization weakness is present regardless of mode. See the mitigation section above.
Exploitation requires a valid authenticated backoffice account. There is no unauthenticated path and no self-registration path.
The severity of this vulnerability is: High. Exploitation requires a valid authenticated backoffice account, with no unauthenticated or self-registration path, and the code execution impact depends on runtime configuration rather than being available by default in every deployment. The rating reflects that the account required is the lowest-privileged backoffice account available, and that where the impact does apply it extends to full compromise of the site and the underlying server.
Umbraco CMS: backoffice data accessible beyond assigned permissions
An access control flaw allowed a user holding low-privilege backoffice access to retrieve content and member data outside the scope of their assigned permissions. This included identifiers for all content items — published as well as unpublished — and for all members, together with the values stored against them.
The issue affects confidentiality only. It does not permit the creation, modification, or deletion of data, and it does not grant backoffice access to unauthenticated users. An attacker must already hold valid backoffice credentials, though any permission level is sufficient.
The severity of this vulnerability is: Moderate. Exploitation requires an authenticated backoffice account and the impact is limited to disclosure, but the disclosure is comprehensive — spanning unpublished content and full member records — and is available to any authenticated user regardless of how narrowly their permissions are set.
Umbraco Forms: sensitive field values and uploads exposed to unauthorised backoffice users
Where a form field was configured as containing sensitive data, the submitted values were written to the search index without protection. Backoffice users able to query the index could read those values whether or not they had been granted access to sensitive data.
The same applied to file upload fields marked as sensitive. The stored path to the uploaded file was written to the index, which allowed an authenticated backoffice user with access to Forms, but without permission to view sensitive data, to retrieve the file itself. Where forms are used to collect documents such as CVs or copies of identification, those documents could be retrieved in this way.
The severity of this vulnerability is: Moderate. Exploitation requires an authenticated backoffice account with access to Forms, and only forms using the sensitive data setting are affected. The rating reflects that the exposure defeats a control specifically intended to protect sensitive submissions, and that the data involved is often personal or identifying.
Umbraco AI: files attached to AI chats served without authentication
When a file is attached to an AI chat in the backoffice, it is stored on the server and served back through an endpoint that allowed anonymous access and did not check whether the caller was entitled to the file. Anyone holding the URL for a specific upload could retrieve it without being signed in.
Exposure is limited: the URL cannot be guessed or enumerated, conversations are not persisted in the releases in scope so the URLs never reach the database, and uploaded files are deleted automatically after 24 hours by default. Realistically a URL could only escape through browser history, a copied link, or access logs. But one that did escape kept working for as long as the file existed, whether or not the person's access to the site had since been revoked, and any backoffice user holding it could read a colleague's upload. The files are whatever a user chose to attach, so they may well be confidential.
The severity of this vulnerability is: Moderate, reflecting that affected files cannot be found without a specific URL and are short-lived by default, weighed against the complete absence of any authentication check.
Credit
We’d like to thank Boris Eetgerink from Novaware for reporting the forms issue, Adam Connell for reporting the privilege escalation and RCE vulnerability, and our AI & security team for the unauthorized information disclosure in the CMS, and AI vulnerabilities.
Any questions?
If you have any questions or comments about this advisory, make sure to get in touch with us directly on the Security Advisories. Alternatively, you can reach out to the dedicated security email address listed at https://umbraco.com/security. Here you can also find information on how we handle security-related issues.
For direct communication related to security in Umbraco products, please sign up for the dedicated security mailing list.
