Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-69197 – Sensitive Information Disclosure – Umbraco CMS Delivery API (12.0.0–13.15.1, 14.0.0

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-69197 is a missing-authorization vulnerability in the Umbraco CMS Content Delivery API that allows unauthenticated remote attackers to read protected content they should not have access to. The flaw stems from the API’s output "expansion" feature for Content Picker and Multi-Node Tree Picker properties, which fails to re-check Public Access / member restrictions and API key scoping on the referenced (expanded) nodes. It carries a CVSS v4.0 base score of 8.7 (High), reflecting a network-exploitable, low-complexity attack with no privileges or user interaction required.

Technical details

  • Root cause: When the Delivery API expands referenced content through Content Picker or Multi-Node Tree Picker properties (including nested pickers inside Block List, Block Grid, and Rich Text Editor blocks), it does not re-apply the access checks that protect the referenced nodes.
  • Trigger conditions: An unprotected document references (via a picker) content that is itself protected by member/Public Access rules or restricted by content type; requesting the unprotected document through the Delivery API with output expansion parameters returns the protected content’s data as well.
  • Attack vector: Network — exploitable via ordinary HTTP requests to the Content Delivery API; no authentication or user interaction is required. Only sites with the Delivery API enabled are affected.
  • Impact: Disclosure of content that was intended to be restricted (protected/Public Access content and type-restricted referenced items), bypassing member authentication and API key restrictions. No integrity or availability impact is reported.

Affected software

  • Umbraco-CMS versions 12.0.0 through 13.15.1 (prior to fix)
  • Umbraco-CMS versions 14.0.0-rc1 through 17.5.3 (prior to fix)
  • Umbraco-CMS versions 18.0.0 through 18.0.2 (prior to fix)
  • Only installations with the Content Delivery API enabled are exploitable.

Severity

  • CVSS v4.0 Base Score: 8.7 (High)
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

  • Immediate: Upgrade to the patched releases: v13.15.1, v17.5.3, or v18.0.2 (or later), depending on your major version track.
  • If unable to patch immediately: Disable the Content Delivery API if it is not actively required — sites with the API disabled are not exposed to this vulnerability. Review any content protected via Public Access or member permissions that is also referenced through Content Picker/Multi-Node Tree Picker properties for potential exposure prior to patching.
  • Projects on unsupported Umbraco major versions will not receive a patch and should upgrade to a currently supported major version.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge