CVE-2026-31834

Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

State: Published
Severity: 7.2 High
Published: Mar 10, 2026
Updated: Mar 11, 2026
Reserved: Mar 9, 2026

Description

Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships. The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles. This vulnerability is fixed in 16.5.1 and 17.2.2.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-269 Improper Privilege Management
CWE-284 Improper Access Control
CWE-862 Missing Authorization

Affected Products

Product	Versions
Umbraco-CMSumbraco	>= 15.3.1, < 16.5.1Affected >= 17.0.0, < 17.2.1Affected

References

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.