Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|
References
History
Wed, 10 Jun 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0. | |
| Title | Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers | |
| Weaknesses | CWE-601 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-06-10T15:56:46.003Z
Reserved: 2026-05-15T19:34:14.012Z
Link: CVE-2026-46616
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-06-10T17:16:37.387
Modified: 2026-06-10T17:16:37.387
Link: CVE-2026-46616
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-06-10T18:30:36Z