What’s Vulnerable › Vulnerabilities

CVE-2024-43377: Umbraco CMS Improper Access Control vulnerability

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-20 · updated 2026-06-17
• Weakness: CWE-284

Description

Umbraco CMS is an ASP.NET CMS. An authenticated user can access a few unintended endpoints. This issue is fixed in 14.1.2.

Affected products

• Umbraco-CMS: from 14.0.0 before 14.1.2 — fixed in 14.1.2

How to fix

Upgrade to a fixed version: Umbraco-CMS 14.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/umbraco/Umbraco-CMS/commit/72bef8861d94a39d5cc9530a04c4797b91fcbecf
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hrww-x3fq-xcvh

Get alerted when CVE-2024-43377 or the next vulnerability affects your stack