GHSL-2026-065: Unauthorized group assignment enables privilege escalation in Umbraco CMS
Published Sep 21, 2026
·Updated
Umbraco CMS lacks authorization checks when assigning users to groups, allowing unauthorized users to escalate privileges.
Affected Software
1 affected component
Umbraco Umbraco CMS
Event History
Sep 21, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
What access would an attacker need to exploit this issue?
The issue involves assigning users to groups without authorization checks, so exploitation requires the ability to perform user-to-group assignment actions. The provided information does not identify the specific account role or endpoint required.
2
What is the security impact of successful exploitation?
An unauthorized user can assign group membership in a way that escalates privileges. The provided information does not specify which groups or privilege levels can be obtained.