CVE-2026-46616

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.

CVSS 3.1

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-601

Published

2026-06-10

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• umbraco:umbraco_cms

References

• https://github.com/umbraco/Umbraco-CMS/pull/22561
• https://github.com/umbraco/Umbraco-CMS/pull/22565
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-2qjj-h6wp-c7h7

Check your stackJSON