Summary
- Ten new fixes cover Umbraco CMS, Forms and AI, including two high-severity findings.
- The more serious paths depend on particular host configurations or existing back-office permissions.
- Umbraco Cloud is receiving CMS and Forms fixes automatically, but AI add-ons require separate updating.
Danish software company Umbraco has released security updates for ten vulnerabilities affecting its content management system, Forms extension and AI modules. Two findings received high-severity ratings, while seven are moderate and one low, according to the vendor’s 27 October advisory.
The most serious CMS issue concerns a combination of weaknesses in back-office sign-in redirects. Under particular hosting arrangements, an attacker could prepare a link that transfers an authenticated staff member’s session to the attacker. If the victim has administrator rights, a successful attack could confer extensive control of content and configuration, with potentially further access through privileged application features.
That description should not be shortened to a universal unauthenticated takeover of every Umbraco deployment. A user must already be signed into the back office and open the crafted link, and the server must accept certain unrecognised host names. Restrictions at the reverse proxy or web-server layer affect whether the entire chain can operate.
Forms permissions and execution
A separate high-severity vulnerability in Umbraco Forms can allow a back-office user who is permitted to configure form workflows to cause server-side code to run. The weakness arises from insufficient restrictions on files written and templates rendered by some workflow steps. The vendor rates this flaw CVSS 8.8.
The necessary privilege is less demanding than full administrator access, but exploitation still requires an authenticated user with access to the Forms section. The server-side execution path depends on runtime view compilation, which Umbraco says is enabled by default. Installations whose Forms managers already have full server-code privileges do not gain an equivalent new trust-boundary exposure.
Other changes address access to form entries and exports, preview-related content visibility, and media or reference information. These issues can expose sensitive data between users who have different back-office permissions even when the public website is not directly compromised. Form submissions may contain personal information, so incorrect segregation within the administrative interface has a privacy dimension as well as a software-security one.
The AI-related corrections concern access-control enforcement for agent tools and the handling of credentials in deployment files. Umbraco notes that the affected content and media agent tools are not switched on by default and that the issues do not permit anonymous exploitation. Administrators need to distinguish an installed AI add-on from a configured tool that can actually operate on site content.
Patch paths differ by product
The vendor has released CMS versions 13.16.3, 17.7.2 and 18.2.2, plus Forms versions 13.9.12, 17.6.2 and 18.2.2. Separate fixed versions have been published for the relevant AI packages. The exact update path therefore depends on the major version and the extensions installed, rather than on a single all-purpose patch.
Umbraco says its hosted Cloud service will automatically roll out CMS and Forms corrections. AI add-ons on those deployments still require manual updates. That distinction matters because customers who rely on the provider to maintain the core platform may nevertheless own the lifecycle of optional components.
Versions 14, 15 and 16 have reached end of life and will not receive fixes for the CMS and Forms vulnerabilities. An organisation on those branches cannot necessarily remove the risk through a small maintenance release; it may require a move to a supported version and testing of custom extensions.
The company offers limited interim measures for some flaws, such as restricting accepted host names or reducing permissions, but says upgrading is the only complete remediation. It has deliberately withheld reproduction details for the Forms code-execution issue while systems remain unpatched.
The advisory also says the issues are unrelated to the recently disclosed PHP vulnerabilities. Umbraco is built on .NET, so administrators should assess the affected packages on their own merits rather than assume the PHP2Shell incident explains this release.
Umbraco did not report a confirmed exploitation campaign in its 27 October advisory. The released fixes cover different components and preconditions, including authenticated Forms workflows, a conditional CMS sign-in chain and optional AI tool permissions. Supported and end-of-life installations consequently have different remediation paths.
