UpHeron
All vulnerabilities

Servers and applications

GHSA-8h2h-5qxc-35c7

v7 XLTS: Missing authentication on Canvas Designer lets anonymous users create, overwrite and delete site style files

Severity
High 7.5
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
7.15.16
Weakness
Missing authentication (CWE-306)Missing authorization (CWE-862)
Attack
Over the network · No login needed · No user action needed
Attacker can
Change data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Sources
Project advisories (GitHub)

Description

The Canvas Designer feature, which generates style files for the site, did not require the caller to be signed in. Anyone who can reach an affected site over the network could create, overwrite and delete the style files it manages, which are served to visitors of the site. Affects Umbraco CMS 7.

Severity: High

Details The Canvas Designer feature, which generates style files for the site, did not require the caller to be signed in. Anyone who can reach an affected site over the network could use it to create, overwrite and delete the style files the feature manages. These files are served to visitors of the site.

As a result, an anonymous attacker could change the content of the site's style files, which alters how pages appear to visitors, or delete those files. The text written to the files is supplied by the caller.

What is exposed. The ability to write and delete the style files managed by this feature.

From umbraco/Umbraco-CMS's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 7.0.0 before 7.15.16

References