CVE-2026-31834

HIGH EPSS 16.9%
Published Mar 10, 20263mo ago · Modified Mar 18, 20263mo ago
7.2 CVSS 3.1
High
Find Similar
Published Mar 10, 2026 3mo ago
Last Modified Mar 18, 2026 3mo ago

Description

Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships. The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles. This vulnerability is fixed in 16.5.1 and 17.2.2.

CVSS Details

Base Score
7.2
Exploitability
1.2
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
16.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 3

CWE-269 Improper Privilege Management Authorization
CWE-284
CWE-862 Missing Authorization Authorization

Affected Products 2

VendorProductVersionRange
umbracoumbraco_cms*≥15.3.1  –  <16.5.1
umbracoumbraco_cms*≥17.0.0  –  <17.2.2

References 1

  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.