Servers and applications
GHSA-48p5-4fgv-rrjw
v7/v8 XLTS: Back-office login checks the password before account lockout, weakening brute-force protection
- Severity
- Medium 6.5
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Added to UpHeron
- 13 Nov 2026
- Fixed in
- 7.15.16, 8.18.18
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read some data · Slow it down
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L- Sources
- Project advisories (GitHub)
Description
The back-office login checks the submitted password before it checks whether the account is locked out. As a result, account lockout does not stop repeated password guessing, and the login's response time can reveal whether a guessed password is correct. No authentication is required. Affects Umbraco CMS 7 and 8.
Severity: Medium
The back-office login checks the submitted password before it checks whether the account is locked out, and it only counts a failed attempt when the password is wrong. A locked account therefore still processes login attempts.
The time the login takes to respond also differs depending on whether the password was correct, including for an account that is currently locked. An attacker can use this to find out whether a guessed password is correct.
What is exposed. Whether a guessed password is correct for a given account. A correct password for a locked account does not sign the attacker in.
Affected software
| Software | Affected versions |
|---|---|
Umbraco CMSServers and applications · github:umbraco/umbraco-cms |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-48p5-4fgv-rrjw
- github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-48p5-4fgv-rrjw