Umbraco CMS EUVD-2026-110831

Exploitation requires that the web server or hosting setup forwards requests for unrecognised host names through to Umbraco - explicitly: Umbraco on Kestrel directly, IIS without host-name bindings, or behind a reverse proxy that forwards the Host header unchanged (per GHSA-rpv9-qp4c-g469); sites where only expected host names reach the application are not exposed to the full chain. It also requires a currently signed-in back-office user to open an attacker-supplied authorization link (UI:P), and the attacker leverages response_mode=form_post plus HTTP Basic client-credential redemption. Impact scales with the victim's role: an administrator victim yields full back-office control and code execution via Razor. Limiting factors: the non-default/permissive host-routing requirement, the required victim interaction, and the attacker's inability to complete the chain without a logged-in operator. The GHSA states there is no configuration setting that fully resolves the issue - upgrading is the only complete fix; interim exposure is reduced by restricting reachable host names (e.g. setting AllowedHosts in appsettings.json or binding the server/proxy to explicit host names) and avoiding opening back-office links from untrusted sources.

Signals point to a serious but conditional, non-commodity risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, score 7.7 High) shows a network-reachable, unauthenticated-to-prepare flaw whose impact is full confidentiality/integrity/availability loss over the vulnerable back-office (VC:H/VI:H/VA:H) with no subsequent-system scope change (SC:N/SI:N/SA:N). Two metrics materially temper real-world exploitability: AT:P reflects the GHSA-confirmed prerequisite that the hosting setup must forward unrecognised Host headers to Umbraco (Kestrel direct, IIS without host bindings, or a reverse proxy passing Host unchanged), and UI:P reflects the need for a signed-in back-office user to open an attacker link. No EPSS score, no CISA KEV listing, and no confirmed working exploit code are present in the input, so there is no evidence of active or automatable mass exploitation; the vuln.today Decision label is 'this_week', consistent with prompt-but-not-emergency handling. The chain is credible and reported by VulnCheck with a vendor patch and detailed advisory, but success depends on both a permissive host-routing configuration and social-engineering a logged-in operator, suggesting targeted rather than widespread exploitation. Net: a genuine high-severity account-takeover/RCE-capable issue that warrants prompt patching, not a high-CVSS-but-hollow finding, yet gated enough that hardened host bindings already blunt it.

An attacker sends a crafted authorization request to an Umbraco site whose web server forwards unrecognised Host headers, poisoning the Host value so an attacker-controlled OAuth redirect URI is registered for the back-office client. The attacker then emails a signed-in back-office administrator an authorization link using response_mode=form_post, captures the returned code, and redeems it via HTTP Basic client credentials to seize an authenticated back-office session and run code through Razor templates. No confirmed public exploit code is identified at time of analysis, though VulnCheck has published a detailed advisory; the AT:P/UI:P metrics mean the attack needs a permissive host configuration and a victim click.