CVE-2026-46609: Umbraco CMS HTML injection in Backoffice confirmation dialog

CVE-2026-46609 · Severity: medium · CVSS 4.6 · Published 2026-06-10

Umbraco, a popular content management system, contains a security flaw where authenticated users can inject malicious code into certain input fields. This code is then displayed to other users in confirmation dialogs, potentially allowing an attacker to perform unauthorized actions or steal session information. The issue affects versions 14.0.0 through 17.3.5 and has been resolved in version 17.4.0.

Technologies: Umbraco.Cms (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2026-46609 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46609 being exploited in the wild.
How severe is CVE-2026-46609?
Medium severity, with a CVSS score of 4.6, published 10 June 2026.
Which products and versions are affected?
Umbraco.Cms (NuGet) >= 14.0.0, <= 17.3.5, ECOSYSTEM:introduced=14.0.0,fixed=17.4.0.
Is there a fix for CVE-2026-46609?
Yes. Umbraco.Cms (NuGet): upgrade to 17.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46609 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46609?
Check whether you run Umbraco.Cms (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Umbraco.Cms (NuGet): upgrade to 17.4.0 or later
    dotnet add package Umbraco.Cms --version 17.4.0

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Umbraco CMS versions 14.0.0 to 17.3.5. The flaw is located in the Backoffice confirmation dialog, where user-supplied input is rendered without adequate output encoding (CWE-79). An authenticated attacker with low privileges can inject malicious HTML/JavaScript into an input field. When another user (typically an administrator) interacts with the affected confirmation dialog, the payload executes in their browser context. This could lead to session hijacking or unauthorized administrative actions. The vulnerability is patched in version 17.4.0.

Affected products

  • Umbraco Umbraco CMS >= 14.0.0, < 17.4.0

Identifiers

  • CVE-2026-46609
  • GHSA-vr9v-27gg-qgx4

Timeline

  • 2026-05-15: advisory: Initial GitHub security advisory published
  • 2026-06-10: disclosed: CVE published to NVD
  • 2026-06-10: patched: Patch released in version 17.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.