CVE-2026-46616CWE-601

Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

Medium · published June 10, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00297 · 21.2th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-06-10T15:56Z
EPSS history
Timeline
  • 10 JUN 15:56Z
    Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
    cvelistv5