Dashboard / CVE-2026-46616

CVE-2026-46616

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 62/100
Published: 2026-06-10 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
umbraco umbraco_cms < 13.14.0

References & Advisories (3)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001800
Percentile 7.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00180
2026-10-28
0.00180

Intelligence Sources

nvd ref →

External Links