PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46616 umbraco CVE debrief

CVE-2026-46616 is a MEDIUM severity vulnerability in Umbraco CMS, a popular ASP.NET-based content management system. Versions prior to 13.14.0 and 17.4.0 are affected. The vulnerability arises from inadequate validation of redirect URLs in certain Surface Controllers, which support member-related operations. This oversight allows attackers to craft malicious redirects, potentially leading to phishing attacks or unauthorized access. The issue has been patched in versions 13.14.0 and 17.4.0.

Vendor
umbraco
Product
Umbraco-CMS
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-12
Advisory published
2026-06-10
Advisory updated
2026-06-12

Who should care

Users of Umbraco CMS, particularly those with versions prior to 13.14.0 or 17.4.0, should be aware of this vulnerability. Site administrators and security teams should assess their current version and apply the necessary patches to mitigate the risk of malicious redirects.

Technical summary

The vulnerability is caused by insufficient validation of redirect URLs in some Surface Controllers of Umbraco CMS. Specifically, Razor templates that derive 'RedirectUrl' from user-controlled query parameters are vulnerable to malicious redirect attacks. The Common Vulnerabilities and Exposures (CVE) score for this issue is 5.4, indicating a MEDIUM severity level. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade to Umbraco CMS version 13.14.0 or 17.4.0, or later, to apply the patch.
  • Review and validate all redirect URLs used in Surface Controllers to ensure they are properly sanitized.
  • Implement additional security measures, such as URL whitelisting, to further mitigate the risk of malicious redirects.

Evidence notes

The vulnerability was patched in versions 13.14.0 and 17.4.0. References to the patches can be found at [ref-4](https://github.com/umbraco/Umbraco-CMS/pull/22561), [ref-5](https://github.com/umbraco/Umbraco-CMS/pull/22565), and [ref-6](https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-2qjj-h6wp-c7h7).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46616 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46616

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46616 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46616

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.