Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes). This vulnerability is fixed in 16.5.1 and 17.2.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-31832 Broken Object-Level Authorization in Umbraco CMS Backoffice API Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31832
Post summary
The text announces CVE-2026-31832 as a broken object-level authorization flaw in Umbraco CMS, with no PoC, exploit, patch, or evidence of active exploitation described.
CVE-2026-31832 Umbraco is an http://ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows … https://www.cve.org/CVERecord?id=CVE-2026-31832
Post summary
The text announces a broken object‑level authorization flaw in Umbraco backoffice API affecting certain versions, referencing the CVE record.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | umbraco | umbraco_cms | - | - | - |