CVE-2026-69197

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-69197
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69197.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-69197
Aliases
Published
2026-09-17T15:44:24Z
Modified
2026-09-19T03:47:23Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
Details

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69197.json"
}
References

Affected packages

Git / github.com/umbraco/umbraco-cms

Affected ranges

Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
ba724ed97d77b9951a22fe693f9dd3bdd000047c
Introduced
8a15c14e7052016b93957e2cddb6c4a6cbe5e6b5
Introduced
c087ce9fb5ca60f371f08d6f5b974c24981e3414
Fixed
5360e2a9681ce2d0024be374e80339260bcc2511
Fixed
a9649da4e5a0786db7688bd6b5036a21df26b015
Fixed
26312a3f717a0f33bb3d7d28b14bef3592bdb0fe
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "13.15.1"
        },
        {
            "introduced": "14.0.0-rc1"
        },
        {
            "fixed": "17.5.3"
        },
        {
            "introduced": "18.0.0"
        },
        {
            "fixed": "18.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release-18.*
release-18.0.0
release-18.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69197.json"