Umbraco CMS CVE-2026-69197

The Content Delivery API must be enabled and configured for public consumption. Two concrete paths exist: (1) with DeliveryApi:PublicAccess enabled, an anonymous caller exploits it with no authentication; (2) when the Delivery API is gated by the organization-wide API key, a valid key holder exploits it. In both cases the content model must contain a publicly-accessible node that references a Public Access-protected node via a Content Picker or Multi-Node Tree Picker (including pickers nested in Block List, Block Grid, or Rich Text Editor blocks), and the attacker uses the ?expand query parameter to serialize the referenced node's property values. LIMITING FACTORS: the Delivery API is opt-in and not enabled by default; exploitation requires a specific content structure where protected content is referenced from unprotected content; impact is confidentiality-only (no write/DoS). The same path also bypasses allowed/disallowed content-type alias restrictions for referenced content. Affected versions are prior to 13.15.1, 17.5.3, and 18.0.2.

This is a genuine, well-substantiated confidentiality vulnerability. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes remote, low-complexity, unauthenticated access to high-value confidential data, yielding an 8.7 (High). My independent view is slightly lower (~7.5 CVSS 3.1) because real-world exploitation is gated by non-default deployment choices - the Content Delivery API must be enabled AND either DeliveryApi:PublicAccess must be turned on (for the anonymous path) or the attacker must hold the organization-wide API key. Against those signals: there is no EPSS score, no CISA KEV listing, and no public exploit code provided in the intelligence, so this is 'no public exploit identified at time of analysis' rather than an actively-exploited threat. The impact is strictly confidentiality - the advisory explicitly states no integrity or availability impact and direct requests for protected nodes still return 401. Net: a real, patch-worthy access-control/information-disclosure flaw that should be prioritized for sites running the Delivery API with Public Access, but it is not a mass-exploitation emergency; the CWE-200 classification and confidentiality-only CVSS are internally consistent and confirmed by the source-code fix (member/Public Access checks added to referenced-node expansion).

On an Umbraco site exposing the Content Delivery API with DeliveryApi:PublicAccess enabled, an anonymous attacker requests a public node that references a members-only/protected node through a Content Picker or Multi-Node Tree Picker (including pickers nested in Block List, Block Grid, or Rich Text Editor blocks), then appends ?expand to force serialization of the referenced node's full property values - retrieving content that a direct request would reject with 401. In the API-key-gated deployment, a key holder performs the same expansion to bypass per-node Public Access. No public proof-of-concept was provided in the intelligence sources.