UpHeron
All vulnerabilities

Servers and applications

CVE-2023-48227

Backoffice User can bypass "Publish" restriction

Severity
Medium 4.3
Published
12 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.18.10, 10.7.0, 12.3.0
Also known as
GHSA-335x-5wcm-8jv2
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a patch for this issue. No known workarounds are available.

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 8.0.0 before 8.18.10
  • From 9.0.0 before 10.7.0
  • From 11.0.0 before 12.3.0
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 8.0.0 before 8.18.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-48227
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-48227
  • GitHub Advisory Database https://github.com/advisories/GHSA-335x-5wcm-8jv2
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-335x-5wcm-8jv2