5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31832

CVE-2026-31832: Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes). This vulnerability is fixed in 16.5.1 and 17.2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31832

CVE-2026-31832:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Umbraco.Cms	nuget	>= 14.0.0, < 16.5.1	16.5.1
Umbraco.Cms	nuget	>= 17.0.0, < 17.2.2	17.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a broken object-level authorization issue within the Umbraco CMS backoffice API. Authenticated users could modify or view domain configurations for content nodes they were not authorized to access. The security patch, identified by comparing versions 17.2.1 and 17.2.2, reveals that authorization checks were missing in key API endpoints.

The analysis of commit 11a412c0fd89c70af2fa76dd3478a3e8024dfeb2 shows that two controller methods were patched:

Umbraco.Cms.Api.Management.Controllers.Document.UpdateDomainsController.Update: This method handles the modification of domain data (PUT /{id:guid}/domains). Before the patch, it failed to verify if the user had the necessary ActionAssignDomain permission for the target content node. This allowed a low-privileged user to alter domain routing for any page on the site.
Umbraco.Cms.Api.Management.Controllers.Document.DomainsController.Domains: This method retrieves domain data (GET /{id:guid}/domains). It was missing a check for ActionBrowse permission, allowing a user to enumerate and view domain configurations of content nodes outside of their authorized section, leading to information disclosure.

The patch introduces explicit authorization checks in both methods using the IAuthorizationService, ensuring that the user has the appropriate permissions for the specific content node before any action is taken. The updated integration tests confirm this fix by changing the expected outcome for unauthorized users from OK to Forbidden. These functions would therefore appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

Umbraco.Cms.Api.Management.Controllers.Document.UpdateDomainsController.Update

src/Umbraco.Cms.Api.Management/Controllers/Document/UpdateDomainsController.cs

This function is responsible for updating domain assignments for a content node. The patch adds an authorization check to verify if the user has 'ActionAssignDomain' permission on the content node before proceeding with the update. The absence of this check allowed unauthorized authenticated users to modify domain settings for content nodes they did not have permission to edit.

Umbraco.Cms.Api.Management.Controllers.Document.DomainsController.Domains

src/Umbraco.Cms.Api.Management/Controllers/Document/DomainsController.cs

This function retrieves the domain assignments for a content node. The patch adds an authorization check to verify if the user has 'ActionBrowse' permission on the content node. The absence of this check allowed unauthorized authenticated users to view domain settings of content nodes they should not have access to, leading to information disclosure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.