{"id":"CVE-2026-117553","kind":"vulnerability","aliases":["CVE-2026-117553"],"related":[],"title":"Umbraco CMS: Host header poisoning lets attackers hijack back-office sessions","description":"Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.","summary":"Umbraco CMS before 17.7.2 and 18.2.2 trusts the Host header when registering OAuth redirect URIs, so an unauthenticated attacker can register their own redirect URI. Attackers send signed-in editors authorization links using response_mode=form_post to capture codes, then redeem them to take over back-office sessions and run code through Razor templates.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asp.net","cms","runtime","self-hosted","umbraco"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Umbraco CMS version in the project's package references; versions below `17.7.2` on the 17 line or below `18.2.2` on the 18 line are affected.\n- unknown","fix":"- Upgrade Umbraco CMS to `17.7.2` or later on the 17 line, or `18.2.2` or later on the 18 line.","status":"open","published_at":"2026-10-27T14:16:35+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","triaged_at":"2026-10-27T14:32:54+00:00","updated_at":"2026-10-27T14:32:54+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T14:32:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Umbraco CMS to `17.7.2` or later on the 17 line, or `18.2.2` or later on the 18 line.","reach":"internet","title":"Umbraco CMS: Host header poisoning lets attackers hijack back-office sessions","impact":"high","summary":"Umbraco CMS before 17.7.2 and 18.2.2 trusts the Host header when registering OAuth redirect URIs, so an unauthenticated attacker can register their own redirect URI. Attackers send signed-in editors authorization links using response_mode=form_post to capture codes, then redeem them to take over back-office sessions and run code through Razor templates.","category":"runtime","nicknames":[],"who_cares":["umbraco","asp.net","self-hosted","cms"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over back-office sessions and runs code via Razor templates","analyst_note":"Confirm the exact vulnerable configuration (whether external OAuth login is required) and check the NVD and Umbraco advisory pages for a how-to-check step.","how_to_check":"- Check the installed Umbraco CMS version in the project's package references; versions below `17.7.2` on the 17 line or below `18.2.2` on the 18 line are affected.\n- unknown","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Sites running Umbraco CMS with the back-office exposed to the internet are the main concern, since the attack starts with a request to the public site and relies on a signed-in editor clicking a link. The sources do not say whether non-default OAuth or external login configurations are required, so teams on older 17.x or 18.x releases should treat themselves as affected until upgraded.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":3373,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117553':15A,18A '-2026':14A,17A '17.7.2':29B,86C '18.2.2':31B,88C 'allow':95C 'asp.net':19B 'attack':7A,44B,51B,97C,101C,111C 'attacker-control':100C 'authent':91C 'author':57B,117C 'back':10A,74B,138C 'back-offic':9A,73B,137C 'basic':132C 'bypass':92C 'captur':65B,125C 'client':133C 'cms':2A,20B,27B,84C 'code':66B,79B,126C,143C 'contain':89C 'control':102C 'credenti':134C 'cve':13A,16A 'editor':56B 'execut':142C 'form':62B,122C 'header':4A,35B,110C 'hijack':8A,136C 'host':3A,24B,34B,109C 'http':131C 'let':6A 'link':58B,118C 'mode':61B,121C 'oauth':38B,103C 'offic':11A,75B,139C 'poison':5A,107C 'post':63B,123C 'razor':81B,145C 'redeem':68B,128C 'redirect':39B,49B,104C 'regist':37B,46B,99C 'respons':60B,120C 'run':78B 'runtim':21B 'self':23B 'self-host':22B 'send':52B,112C 'session':12A,76B,140C 'sign':54B,114C 'signed-in':53B,113C 'take':71B 'templat':82B,146C 'trust':32B 'umbraco':1A,25B,26B,83C 'unauthent':43B,96C 'uri':40B,50B,105C 'use':59B,119C 'user':116C 'via':130C 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running Umbraco CMS with the back-office exposed to the internet are the main concern, since the attack starts with a request to the public site and relies on a signed-in editor clicking a link. The sources do not say whether non-default OAuth or external login configurations are required, so teams on older 17.x or 18.x releases should treat themselves as affected until upgraded.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117553","severity":null,"published_at":"2026-10-27T14:16:35+00:00","modified_at":"2026-10-27T14:16:35+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","fetched_at":"2026-10-27T14:32:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}