CVE-2026-46616: Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
Impact Some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks.
Patches The issue is resolved in versions 17.4.0 and 13.14.0.
Workarounds If users cannot upgrade immediately, they can mitigate the issue in their own site by ensuring every Razor form that posts to UmbLoginStatusController, UmbProfileController or UmbRegisterController passes a concrete, trusted RedirectUrl into Html.BeginUmbracoForm's route values.
For example:
cshtml @using (Html.BeginUmbracoForm<UmbLoginStatusController>( "HandleLogout", new { RedirectUrl = Model.Url() })) { <button type="submit">Log out</button> }
Resources
https://github.com/umbraco/Umbraco-CMS/pull/22565 https://github.com/umbraco/Umbraco-CMS/pull/22561
Other sources
Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Umbraco.Cmsto a version that resolves this vulnerability.Fixed in 17.4.0 - Upgrade
Upgrade
nuget/Umbraco.Cmsto a version that resolves this vulnerability.Fixed in 13.14.0 - Configuration
Ensure every Razor form that posts to UmbLoginStatusController, UmbProfileController, or UmbRegisterController provides a concrete, trusted RedirectUrl in the Html.BeginUmbracoForm route values (do not pass RedirectUrl derived directly from user-controlled query parameters). For example, pass a Model.Url() or other server-validated URL as the RedirectUrl route value.
Razor forms (Html.BeginUmbracoForm) RedirectUrl = concrete, trusted URL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46616?
CVE-2026-46616 has a medium severity rating of 5.4.
What risks are associated with CVE-2026-46616?
CVE-2026-46616 allows for malicious redirect attacks due to improper validation of redirect URLs.
How do I fix CVE-2026-46616?
The issue in CVE-2026-46616 is resolved in the latest version of Umbraco.Cms.
Which versions of Umbraco.Cms are affected by CVE-2026-46616?
CVE-2026-46616 affects versions of Umbraco.Cms that do not implement the latest security patches.
When was CVE-2026-46616 published?
CVE-2026-46616 was published on May 21, 2026.