CVE-2026-46616 Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

What is CVE-2026-46616?

CVE-2026-46616 is a medium-severity vulnerability in Umbraco Umbraco Cms, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.

Weakness: CWE-601

Which versions are affected by CVE-2026-46616?

4 open source packages ship an affected version, including Umbraco.Cms. It affects 1 product.

Products include Umbraco Umbraco Cms.

How do I fix CVE-2026-46616?

Upgrade Umbraco.Cms to a fixed version for your release line: 13.14.0 or 17.4.0.

Is CVE-2026-46616 being exploited?

There is no known exploitation of CVE-2026-46616 in the wild and no public exploit code.

Other vulnerabilities in Umbraco Umbraco Cms

• CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability Critical 10.0
• CVE-2014-10074 File upload in n/a Critical 9.8
• CVE-2012-1301 Server-side request forgery in n/a Critical 9.8
• CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE Critical 9.3
• CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users High 8.8

All Umbraco Umbraco Cms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2qjj-h6wp-c7h7.