CVE-2026-69197
1 advisory.
NuGet/Umbraco.Cms CVE-2026-69197: high
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
Action: Upgrade Umbraco.Cms to 13.15.1 (13.x), 17.5.3 (17.x) or 18.0.2 (18.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.0.0 | 13.15.1 | - |
| 14.0.0-rc1 | 17.5.3 | - |
| 18.0.0 | 18.0.2 | - |
Fixed versions
| 13.15.1 | 17.5.3 | 18.0.2 |
Sources
- osv: GHSA-wr57-hqmp-fgvh
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh
- https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe
- https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511
- https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015
- https://github.com/umbraco/Umbraco-CMS
- https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1
- https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3
- https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2
CVE-2026-69197 · published · modified · JSON