UpHeron
All vulnerabilities

Servers and applications

CVE-2023-49273

Privilege Escalation using Spoofing

Severity
Medium 5.4
Published
12 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.18.10, 10.8.1, 12.3.4
Also known as
GHSA-cfr5-7p54-4qg8
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 8.0.0 before 8.18.10
  • From 10.0.0 before 10.8.1
  • From 12.0.0 before 12.3.4
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 8.0.0 before 8.18.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-49273
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-49273
  • GitHub Advisory Database https://github.com/advisories/GHSA-cfr5-7p54-4qg8
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-cfr5-7p54-4qg8