Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-69197— Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Quick assessment

Affected
umbraco Umbraco-CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Umbraco 是一个基于 ASP.NET 的内容管理系统（CMS）。在 13.15.1、17.5.3 和 18.0.2 版本之前，其内容交付 API（Content Delivery API）仅对直接请求的节点应用成员身份和公开访问（Public Access）检查，而不会对通过“内容选择器”（Content Picker）或“多节点树选择器”（Multi-Node Tree Picker）属性序列化引用的节点执行此类检查，包括嵌套在“块列表”（Block List）、“块网格”（Block Grid）或“富文本

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-69197

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
Source: CVE Program / CVE List V5
Vulnerability Description
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
umbraco Umbraco-CMS >= 12.0.0, < 13.15.1 -

II. Public POCs for CVE-2026-69197

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-69197

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-69197 (3)

Vendor Advisories for CVE-2026-69197 (1)

Vendor Pages for CVE-2026-69197 (3)

IV. Related Vulnerabilities

Same product: Umbraco-CMS
Same vendor: umbraco
Same weakness: CWE-200

V. Comments for CVE-2026-69197

No comments yet

Leave a comment