Is CVE-2026-46616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46616 being exploited in the wild.

How severe is CVE-2026-46616?

Medium severity, with a CVSS score of 5.4, published 10 June 2026.

Which products and versions are affected?

Umbraco.Cms (NuGet) ECOSYSTEM:introduced=0,fixed=13.14.0.

Is there a fix for CVE-2026-46616?

Yes. Umbraco.Cms (NuGet): upgrade to 13.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46616 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46616?

Check whether you run Umbraco.Cms (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46616: Umbraco CMS open redirect in member Surface Controllers

CVE-2026-46616 · Severity: medium · CVSS 5.4 · Published 2026-06-10

Umbraco, a popular content management system, contains a security flaw that could allow attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link, an attacker can make a legitimate Umbraco site send the user to a phishing or malware site, potentially damaging the organization's reputation and leading to credential theft. This issue affects specific member-related features like login status, registration, and profile management.

Technologies: Umbraco.Cms (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2026-46616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46616 being exploited in the wild.
How severe is CVE-2026-46616?: Medium severity, with a CVSS score of 5.4, published 10 June 2026.
Which products and versions are affected?: Umbraco.Cms (NuGet) ECOSYSTEM:introduced=0,fixed=13.14.0.
Is there a fix for CVE-2026-46616?: Yes. Umbraco.Cms (NuGet): upgrade to 13.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46616 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46616?: Check whether you run Umbraco.Cms (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Umbraco.Cms (NuGet): upgrade to 13.14.0 or later

dotnet add package Umbraco.Cms --version 13.14.0

Technical details

An open redirect vulnerability exists in Umbraco CMS due to insufficient validation of the 'RedirectUrl' parameter within specific Surface Controllers, namely UmbLoginStatusController, UmbRegisterController, and UmbProfileController. The root cause is the failure to verify if a redirect destination is local before execution. An unauthenticated remote attacker can exploit this by crafting a URL that includes a malicious external destination in the query parameters. If a user interacts with this link, the application will redirect them to the attacker-controlled site. The vulnerability has been addressed in versions 13.14.0 and 17.4.0 by implementing 'Url.IsLocalUrl()' validation.

Affected products

Umbraco Umbraco CMS < 13.14.0, < 17.4.0

Identifiers

CVE-2026-46616
GHSA-2qjj-h6wp-c7h7

Timeline

2026-04-22: other: Fixes submitted via pull requests 22561 and 22565
2026-05-15: advisory: GitHub Security Advisory published
2026-06-10: disclosed: CVE-2026-46616 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.