CVE-2026-46616

6.1 Moyenne

Publiée le 10/06/2026 à 19:16 · Modifiée le 17/06/2026 à 12:53 · Analysée par le NVD · Source : security-advisories@github.com

Description

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`
3.1	6.1 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-601

Références

https://github.com/umbraco/Umbraco-CMS/pull/22561 Issue TrackingPatch
https://github.com/umbraco/Umbraco-CMS/pull/22565 Issue TrackingPatch
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-2qjj-h6wp-c7h7 MitigationVendor Advisory

CVE-2026-46616

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs