CVE-2023-48227: Umbraco CMS Backoffice User can bypass "Publish" restriction
Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios.
Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request body of the "Send for Approval" request.
Other sources
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-48227?
CVE-2023-48227 has a moderate severity level due to the potential for unauthorized content publication.
How do I fix CVE-2023-48227?
To fix CVE-2023-48227, update to Umbraco CMS version 12.3.0, 10.8.0, or 8.18.10 as applicable.
Who is affected by CVE-2023-48227?
Backoffice users of Umbraco CMS versions between 8.0.0 and 12.3.0 with send for approval permissions but lacking publish permissions are affected.
What can attackers do with CVE-2023-48227?
Attackers can exploit CVE-2023-48227 to publish content despite lacking the intended permissions.
When was CVE-2023-48227 disclosed?
CVE-2023-48227 was disclosed in 2023 as part of a vulnerability advisory regarding Umbraco CMS.