CVE-2026-31832

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31832", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T17:41:56.077Z", "datePublished": "2026-03-10T21:49:54.908Z", "dateUpdated": "2026-03-11T15:58:54.874Z"}, "containers": {"cna": {"title": "Umbraco Backoffice API Allows Unauthorized Modification of Domain Data", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fpvf-fvp5-996r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fpvf-fvp5-996r"}], "affected": [{"vendor": "umbraco", "product": "Umbraco-CMS", "versions": [{"version": ">= 14.0.0, < 16.5.1", "status": "affected"}, {"version": ">= 17.0.0, < 17.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:49:54.908Z"}, "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes). This vulnerability is fixed in 16.5.1 and 17.2.2."}], "source": {"advisory": "GHSA-fpvf-fvp5-996r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:51:47.612334Z", "id": "CVE-2026-31832", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:58:54.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Umbraco Backoffice API Allows Unauthorized Modification of Domain Data", "source": {"advisory": "GHSA-fpvf-fvp5-996r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "umbraco", "product": "Umbraco-CMS", "versions": [{"status": "affected", "version": ">= 14.0.0, < 16.5.1"}, {"status": "affected", "version": ">= 17.0.0, < 17.2.0"}]}], "references": [{"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fpvf-fvp5-996r", "name": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fpvf-fvp5-996r", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes). This vulnerability is fixed in 16.5.1 and 17.2.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:49:54.908Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31832", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T15:51:47.612334Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T15:51:49.053Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-31832", "state": "PUBLISHED", "dateUpdated": "2026-03-10T21:49:54.908Z", "dateReserved": "2026-03-09T17:41:56.077Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T21:49:54.908Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Umbraco-CMS", "vendor": "umbraco", "versions": [{"status": "affected", "version": ">= 14.0.0, < 16.5.1"}, {"status": "affected", "version": ">= 17.0.0, < 17.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "76863BD0-FD31-4007-96C0-F0C4651AE792", "versionEndExcluding": "16.5.1", "versionStartIncluding": "14.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C8D4B05-B561-4CDB-8B2A-BD734F9E9A74", "versionEndExcluding": "17.2.2", "versionStartIncluding": "17.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes). This vulnerability is fixed in 16.5.1 and 17.2.2."}, {"lang": "es", "value": "Umbraco es un CMS de ASP.NET. Desde la versi\u00f3n 14.0.0 hasta antes de la 16.5.1 y la 17.2.2, existe una vulnerabilidad de autorizaci\u00f3n a nivel de objeto rota en un endpoint de API del backoffice que permite a usuarios autenticados asignar datos relacionados con dominios a nodos de contenido sin las comprobaciones de autorizaci\u00f3n adecuadas. El problema es causado por una aplicaci\u00f3n de autorizaci\u00f3n insuficiente en el endpoint de API afectado, por la cual, a trav\u00e9s de una llamada a la API, se pueden establecer dominios en nodos de contenido a los que el editor no tiene permiso para acceder (ya sea a trav\u00e9s de privilegios de grupo de usuarios o nodos de inicio). Esta vulnerabilidad est\u00e1 corregida en la 16.5.1 y la 17.2.2."}], "id": "CVE-2026-31832", "lastModified": "2026-06-17T10:34:32.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31832", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:51:47.612334Z", "version": "2.0.3"}}]}, "published": "2026-03-10T22:16:21.257", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fpvf-fvp5-996r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[14.0.0,16.5.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.0,17.2.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "cms", "vendor": "umbraco"}], "analysis": {"en": {"generated_at": "2026-04-16T03:05:49.089770+00:00", "value": {"mitigation_remediation": ["Upgrade to a patched release (at least 16.5.1 or 17.2.2).", "If immediate upgrade is not possible, restrict the backoffice API endpoint to administrators or remove domain assignment functionality entirely.", "Monitor API activity for unauthorized domain assignment attempts and review user permissions to limit scope of access."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Umbraco CMS versions from 14.0.0 up to, but not including, 16.5.1 and from older releases up to, but not including, 17.2.2. Users running these CMS releases should review their installations to determine if they are on a vulnerable version.", "description_and_impact": "Umbraco CMS has a broken object\u2011level authorization flaw in a backoffice API that lets any authenticated user assign domains to content nodes without proper access checks. This failure allows a user who should not have permission to modify a node to attach arbitrary domain data, potentially enabling domain hijacking, phishing, or brand impersonation. The weakness is classified as CWE\u2011639 and results in unauthorized data integrity compromise, but does not provide remote code execution or service disruption.", "risk_and_exploitability": "The CVSS base score is 5.4, indicating a moderate severity. The EPSS score is less than 1\u202f%, showing a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and an API call to the affected endpoint; no additional privileges or network access beyond normal user credentials are needed. Given the limited exposure, the overall risk is moderate but should be addressed promptly to prevent potential domain manipulation. "}}}}, "created": "2026-03-11T11:41:59.544769+00:00", "updated": "2026-04-16T03:15:22.944773+00:00", "vendors": ["umbraco", "umbraco$PRODUCT$cms"]}