Executive brief
Umbraco's Delivery API, used to serve content to websites and applications, fails to enforce access control when retrieving referenced content through picker fields. An unauthenticated attacker can access member-gated or protected content (such as pricing pages, internal documents, or subscription-only articles) by accessing public pages that reference them, revealing full content details when using expansion parameters. Direct requests for the protected content correctly deny access, making this bypass difficult to detect.
Technical details
This is a missing authorization (CWE-862) and information exposure (CWE-200) vulnerability in the Umbraco Delivery API's content serialization layer. The root cause is that Public Access protection and content-type alias-based restrictions are enforced only at the HTTP controller layer for directly requested nodes, not during property expansion of referenced content. When a publicly readable node contains a Content Picker, Multi-Node Tree Picker, or nested Block List/Block Grid/Rich Text Editor fields pointing to protected content, the API serializes the referenced protected nodes without re-validating access. An unauthenticated attacker can craft requests using the ?expand query parameter on picker properties to retrieve full protected content details. Impact increases when the Delivery API is configured with public access (DeliveryApi:PublicAccess: true), but exploitation remains possible even with org-wide API key gating, where the key holder bypasses per-node protections. Patches are available in versions 13.15.1, 17.5.3, and 18.0.2.
Affected products
- Umbraco Umbraco CMS 12.0.0 to 13.15.0, 14.0.0-rc1 to 17.5.2, 18.0.0 to 18.0.1
Timeline
- 2026-07-07: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-09-17: patched: Patches released: versions 13.15.1, 17.5.3, 18.0.2