Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M

CVE-2026-46616Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

Medium 5.4

In plain English

A medium-severity open redirect in Umbraco-CMS from umbraco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 92.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	umbraco.cms	13.14.0	GHSA-2qjj-h6wp-c7h7
NuGet	umbraco.cms	17.4.0	GHSA-2qjj-h6wp-c7h7

Affected products (as reported)

Vendor	Product	Versions
umbraco	Umbraco-CMS	< 13.14.0>= 17.3.0-rc, < 17.4.0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-2qjj-h6wp-c7h7 x_refsource_CONFIRM
https://github.com/umbraco/Umbraco-CMS/pull/22561 x_refsource_MISC
https://github.com/umbraco/Umbraco-CMS/pull/22565 x_refsource_MISC