Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-117553: Umbraco CMS allows attackers to hijack admin sessions
CVE-2026-117553 · published today
Summary
Versions of Umbraco CMS before 17.7.2 and 18.2.2 let an unauthenticated user change the Host header to add their own OAuth redirect address. By sending a crafted link to a logged‑in user, the attacker can capture the authorization code and take over the back‑office account, potentially running code on the site. Upgrade to the latest releases (17.7.2, 18.2.2 or newer) to close the gap.
Original advisory text
Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
References
- https://github.com/umbraco/Umbraco-CMS Product
- https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.1/src/Umbraco.Cms.Api.M... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/117xxx/CVE-2026-1175... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-117553 Vendor Advisory
- https://github.com/umbraco/Umbraco-CMS/commit/490b9b27dcbb8fb3fe868a36203590968b... Patch
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rpv9-qp4c-g469 Vendor Advisory
- https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.2-and-18.2.2-accoun... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.9
Critical
Type
CWE-601Open Redirect
Timeline
Published27 Oct 2026
Updated28 Oct 2026
First seen27 Oct 2026
Track software like this
Free during beta