Content Delivery API Vulnerability in Umbraco CMS
CVE-2026-69197
What is CVE-2026-69197?
The Content Delivery API in Umbraco CMS applications prior to versions 13.15.1, 17.5.3, and 18.0.2 is susceptible to an access control vulnerability. This allows anonymous users or holders of organization-wide API keys to bypass public access restrictions for protected content by exploiting referenced nodes through Content Picker or Multi-Node Tree Picker properties. While direct requests for protected nodes return a 401 status, the ability to retrieve protected node names, routes, and IDs through unprotected references presents a significant risk. This vulnerability potentially exposes sensitive information and requires immediate attention to secure the affected systems.
Affected Version(s)
Umbraco-CMS >= 12.0.0, < 13.15.1 < 12.0.0, 13.15.1
Umbraco-CMS >= 14.0.0-rc1, < 17.5.3 < 14.0.0-rc1, 17.5.3
Umbraco-CMS >= 18.0.0, < 18.0.2 < 18.0.0, 18.0.2