{"id":"CVE-2026-46616","aliases":["GHSA-2qjj-h6wp-c7h7"],"url":"https://o3.security/vulnerability/CVE-2026-46616","summary":"Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers","details":"### Impact\nSome of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks.\n\n### Patches\nThe issue is resolved in versions 17.4.0 and 13.14.0.\n\n### Workarounds\nIf users cannot upgrade immediately, they can mitigate the issue in their own site by ensuring every Razor form that posts to `UmbLoginStatusController`, `UmbProfileController` or `UmbRegisterController` passes a concrete, trusted `RedirectUrl` into `Html.BeginUmbracoForm's` route values. \n\nFor example:\n\n```cshtml\n  @using (Html.BeginUmbracoForm<UmbLoginStatusController>(\n      \"HandleLogout\",\n      new { RedirectUrl = Model.Url() }))\n  {\n      <button type=\"submit\">Log out</button>\n  }\n```\n\n### Resources\n\nhttps://github.com/umbraco/Umbraco-CMS/pull/22565\nhttps://github.com/umbraco/Umbraco-CMS/pull/22561","published":"2026-06-10T15:56:46.003Z","modified":"2026-08-12T03:51:13.790831060Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"score":0.0018,"percentile":0.07745,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"Umbraco.Cms","fixedVersion":"13.14.0"},{"ecosystem":"NuGet","name":"Umbraco.Cms","fixedVersion":"17.4.0"}],"fix":{"url":"https://github.com/umbraco/Umbraco-CMS/pull/22561","label":"umbraco/Umbraco-CMS#22561"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46616.json"},{"type":"ADVISORY","url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-2qjj-h6wp-c7h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46616"},{"type":"FIX","url":"https://github.com/umbraco/Umbraco-CMS/pull/22561"},{"type":"FIX","url":"https://github.com/umbraco/Umbraco-CMS/pull/22565"},{"type":"PACKAGE","url":"https://github.com/umbraco/Umbraco-CMS"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.790831060Z"}}