CVE-2026-31834

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31834
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31834.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-31834
Aliases
Published
2026-03-10T21:53:49.153Z
Modified
2026-08-12T03:51:14.026709270Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
Details

Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships. The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles. This vulnerability is fixed in 16.5.1 and 17.2.2.

Database specific 
{
    "cwe_ids": [
        "CWE-269",
        "CWE-284",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31834.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/umbraco/umbraco-cms

Affected ranges

Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
06a2a500b358ce15b1e228391eb60bd517c6e833
Fixed
8555a97b399e2a26379804ce753ee74bfa48b09e
Introduced
da502e06ae836057de372c7c2ed69a1221c3d3b4
Fixed
11a412c0fd89c70af2fa76dd3478a3e8024dfeb2
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "15.3.1"
        },
        {
            "fixed": "16.5.1"
        },
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.2.2"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31834.json"