CVE-2026-31834

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31834", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T17:41:56.077Z", "datePublished": "2026-03-10T21:53:49.153Z", "dateUpdated": "2026-03-11T15:58:38.854Z"}, "containers": {"cna": {"title": "Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp"}], "affected": [{"vendor": "umbraco", "product": "Umbraco-CMS", "versions": [{"version": ">= 15.3.1, < 16.5.1", "status": "affected"}, {"version": ">= 17.0.0, < 17.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:53:49.153Z"}, "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships. The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles. This vulnerability is fixed in 16.5.1 and 17.2.2."}], "source": {"advisory": "GHSA-rhcg-3h8r-v6vp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T15:52:28.368757Z", "id": "CVE-2026-31834", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:58:38.854Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks", "source": {"advisory": "GHSA-rhcg-3h8r-v6vp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "umbraco", "product": "Umbraco-CMS", "versions": [{"status": "affected", "version": ">= 15.3.1, < 16.5.1"}, {"status": "affected", "version": ">= 17.0.0, < 17.2.1"}]}], "references": [{"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp", "name": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships. The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles. This vulnerability is fixed in 16.5.1 and 17.2.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T21:53:49.153Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31834", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T15:52:28.368757Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-11T15:52:29.661Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-31834", "state": "PUBLISHED", "dateUpdated": "2026-03-10T21:53:49.153Z", "dateReserved": "2026-03-09T17:41:56.077Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T21:53:49.153Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Umbraco-CMS", "vendor": "umbraco", "versions": [{"status": "affected", "version": ">= 15.3.1, < 16.5.1"}, {"status": "affected", "version": ">= 17.0.0, < 17.2.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FA45ECC-C70C-4D28-8989-0784AD7311CF", "versionEndExcluding": "16.5.1", "versionStartIncluding": "15.3.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C8D4B05-B561-4CDB-8B2A-BD734F9E9A74", "versionEndExcluding": "17.2.2", "versionStartIncluding": "17.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships. The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles. This vulnerability is fixed in 16.5.1 and 17.2.2."}, {"lang": "es", "value": "Umbraco es un CMS de ASP.NET. Desde 15.3.1 hasta antes de 16.5.1 y 17.2.2, ha sido identificada una vulnerabilidad de escalada de privilegios en Umbraco CMS. Bajo ciertas condiciones, los usuarios autenticados del backoffice con permiso para gestionar usuarios, podr\u00edan elevar sus privilegios debido a una aplicaci\u00f3n insuficiente de la autorizaci\u00f3n al modificar las membres\u00edas de grupos de usuarios. La funcionalidad afectada no valida correctamente si un usuario tiene privilegios suficientes para asignar roles altamente privilegiados. Esta vulnerabilidad est\u00e1 corregida en 16.5.1 y 17.2.2."}], "id": "CVE-2026-31834", "lastModified": "2026-06-17T10:34:32.713", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31834", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:52:28.368757Z", "version": "2.0.3"}}]}, "published": "2026-03-10T22:16:21.567", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.3.1,16.5.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.0,17.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Umbraco-CMS", "source": "cna", "vendor": "umbraco"}, "product": "umbraco_cms", "vendor": "umbraco"}], "analysis": {"en": {"generated_at": "2026-04-16T09:22:31.672807+00:00", "value": {"mitigation_remediation": ["Upgrade Umbraco to version 16.5.1 or 17.2.2, which implements proper authorization checks on user group changes.", "Revoke or remove user\u2011management permissions from non\u2011administrator backoffice users until the fix is applied, ensuring that only critical roles can alter group memberships.", "Audit backoffice role definitions and enforce least privilege, applying necessary restrictions and monitoring changes to user groups for anomalous activity."], "summary": {"action": "Patch Now", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Umbraco CMS versions from 15.3.1 up to, but not including, 16.5.1 and 17.2.2. Administrators should verify that their deployment runs a fixed release, namely 16.5.1 or 17.2.2, or later.", "description_and_impact": "A deficiency in Umbraco CMS caused a vertical privilege escalation where authenticated backoffice users who can manage users may assign high\u2011privilege roles to themselves or others. The flaw lies in missing authorization checks on user group modifications, enabling the elevation of privileges without proper enforcement. This represents missing authorization checks (CWE\u2011269), insufficient access control (CWE\u2011284), and lack of privilege verification (CWE\u2011862). Consequently, a malicious or inadvertently misused authenticated user could gain administrative control over the site.", "risk_and_exploitability": "The CVSS score of 7.2 indicates moderate to high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no widespread publicly available exploits. Attackers would need authenticated backoffice access with user\u2011management rights to exploit the flaw, and could then promote themselves to a privileged role through the unprotected user group interface."}}}}, "created": "2026-03-11T11:39:10.485742+00:00", "updated": "2026-04-16T09:30:06.045047+00:00", "vendors": ["umbraco", "umbraco$PRODUCT$umbraco_cms"]}