5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46616

CVE-2026-46616: Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious redirect attacks. This issue has been patched in versions 13.14.0 and 17.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46616

CVE-2026-46616:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Umbraco.Cms	nuget	< 13.14.0	13.14.0
Umbraco.Cms	nuget	>= 17.3.0-rc, < 17.4.0	17.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in three surface controllers within the Umbraco CMS: UmbLoginStatusController, UmbProfileController, and UmbRegisterController. These controllers handle member-related operations and were found to have an open redirect vulnerability. The issue stems from the fact that these controllers accepted a RedirectUrl from user-controlled input (e.g., query parameters) and performed a redirect without validating whether the URL was local to the application. An attacker could exploit this by crafting a malicious link that, when clicked by a user, would redirect them to an external, potentially harmful, website after performing an action like logging out, updating their profile, or registering. The patch for this vulnerability, as seen in the provided commits, involves adding a check using Url.IsLocalUrl() to ensure that the RedirectUrl is a local URL before performing the redirect. This prevents the application from redirecting users to external sites.

Vulnerable functions

Umbraco.Cms.Web.Website.Controllers.UmbLoginStatusController.HandleLogout

src/Umbraco.Web.Website/Controllers/UmbLoginStatusController.cs

The `HandleLogout` function in `UmbLoginStatusController` is vulnerable to an open redirect. It uses a user-provided `RedirectUrl` without proper validation, allowing an attacker to craft a URL that redirects users to a malicious site after they log out.

Umbraco.Cms.Web.Website.Controllers.UmbProfileController.HandleUpdateProfile

src/Umbraco.Web.Website/Controllers/UmbProfileController.cs

The `HandleUpdateProfile` function in `UmbProfileController` is vulnerable to an open redirect. It uses a user-provided `RedirectUrl` without proper validation, allowing an attacker to craft a URL that redirects users to a malicious site after they update their profile.

Umbraco.Cms.Web.Website.Controllers.UmbRegisterController.HandleRegisterMember

src/Umbraco.Web.Website/Controllers/UmbRegisterController.cs

The `HandleRegisterMember` function in `UmbRegisterController` is vulnerable to an open redirect. It uses a user-provided `RedirectUrl` without proper validation, allowing an attacker to craft a URL that redirects users to a malicious site after they register.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.