Description A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships.
The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles.
Impact An authenticated backoffice user may be able to escalate their privileges to Administrator level.
Successful exploitation results in full administrative control of the affected Umbraco CMS instance, including unrestricted access to content, user management, and configuration settings.
The impact is significantly mitigated by the fact that this can only be exploited by a user that has already been given access to the "Users" section in the CMS. For most Umbraco setups, such users are already also "Administrators".
Patches The issue is patched in 16.5.1 and 17.2.2.
Workarounds There is no workaround other than upgrading for setups where they want to have users with permission for the "Users" section without also being content with those users also being part of the "Administrators" user group.
Description An authenticated backoffice user with access to Settings can inject malicious HTML into property type descriptions. Due to an overly permissive attributeNameCheck configuration (/.+/) in the UFM DOMPurify instance, event handler attributes such as onclick and onload, when used within Umbraco web components (umb-, uui-, ufm-) were not filtered.
Impact As property type descriptions support Markdown/HTML via the UFM rendering pipeline, injected event handlers are rendered in the backoffice interface, resulting in a stored XSS affecting other backoffice users.
Patches The issue is patched in 16.5.1 and 17.2.2.
Workarounds There is no workaround other than upgrading.
References https://docs.umbraco.com/umbraco-cms/reference/umbraco-flavored-markdown
Description A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks.
The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes).
Impact An attacker can modify domain configurations for content nodes they are not permitted to edit. This may result in malicious or unintended routing behaviour, service disruption, and potential disclosure of configuration-related information.
Patches The issue is patched in 16.5.1 and 17.2.2.
Workarounds There is no workaround other than upgrading.