# CVE-2026-69197: Umbraco Delivery API authorization bypass in content reference expansion

Source: https://junglewise.ai/threats/cve-2026-69197-umbraco-delivery-api-authorization-bypass-in-content-reference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69197 · Severity: high · CVSS 4 · Published 2026-09-17

Umbraco's Delivery API, used to serve content to websites and applications, fails to enforce access control when retrieving referenced content through picker fields. An unauthenticated attacker can access member-gated or protected content (such as pricing pages, internal documents, or subscription-only articles) by accessing public pages that reference them, revealing full content details when using expansion parameters. Direct requests for the protected content correctly deny access, making this bypass difficult to detect.

Technologies: [Umbraco.Cms (NuGet)](https://junglewise.ai/threats/technologies/umbraco-cms). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-69197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69197 being exploited in the wild.

**How severe is CVE-2026-69197?** High severity, with a CVSS score of 4, published 17 September 2026.

**Which products and versions are affected?** Umbraco.Cms (NuGet) ECOSYSTEM:introduced=12.0.0,fixed=13.15.1.

**Is there a fix for CVE-2026-69197?** Yes. Umbraco.Cms (NuGet): upgrade to 13.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69197 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-69197?** Check whether you run Umbraco.Cms (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Umbraco.Cms (NuGet): upgrade to 13.15.1 or later

  ```sh
  dotnet add package Umbraco.Cms --version 13.15.1
  ```


## Technical details

This is a missing authorization (CWE-862) and information exposure (CWE-200) vulnerability in the Umbraco Delivery API's content serialization layer. The root cause is that Public Access protection and content-type alias-based restrictions are enforced only at the HTTP controller layer for directly requested nodes, not during property expansion of referenced content. When a publicly readable node contains a Content Picker, Multi-Node Tree Picker, or nested Block List/Block Grid/Rich Text Editor fields pointing to protected content, the API serializes the referenced protected nodes without re-validating access. An unauthenticated attacker can craft requests using the ?expand query parameter on picker properties to retrieve full protected content details. Impact increases when the Delivery API is configured with public access (DeliveryApi:PublicAccess: true), but exploitation remains possible even with org-wide API key gating, where the key holder bypasses per-node protections. Patches are available in versions 13.15.1, 17.5.3, and 18.0.2.

## Affected products

- Umbraco Umbraco CMS 12.0.0 to 13.15.0, 14.0.0-rc1 to 17.5.2, 18.0.0 to 18.0.1

## Identifiers

- CVE-2026-69197
- GHSA-wr57-hqmp-fgvh

## Timeline

- 2026-07-07: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-09-17: patched: Patches released: versions 13.15.1, 17.5.3, 18.0.2

## References

- [https://api.github.com/users/suryadina](https://api.github.com/users/suryadina)
- [https://github.com/suryadina](https://github.com/suryadina)
- [https://api.github.com/users/suryadina/gists%7B/gist_id%7D](https://api.github.com/users/suryadina/gists%7B/gist_id%7D)
- [https://api.github.com/users/suryadina/repos](https://api.github.com/users/suryadina/repos)
- [https://avatars.githubusercontent.com/u/20553653?v=4](https://avatars.githubusercontent.com/u/20553653?v=4)
- [https://api.github.com/users/suryadina/events%7B/privacy%7D](https://api.github.com/users/suryadina/events%7B/privacy%7D)

## Related threats

- [Umbraco CMS open redirect in member Surface Controllers](https://junglewise.ai/threats/cve-2026-46616-umbraco-cms-open-redirect-in-member-surface-controllers)
- [Umbraco CMS HTML injection in Backoffice confirmation dialog](https://junglewise.ai/threats/cve-2026-46609-umbraco-cms-html-injection-in-backoffice-confirmation-dialog)
- [Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks](https://junglewise.ai/threats/cve-2026-31834-umbraco-affected-by-vertical-privilege-escalation-via-missing)
- [Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering](https://junglewise.ai/threats/cve-2026-31833-umbraco-has-stored-xss-in-ufm-rendering-pipeline-via-permissive)
- [Umbraco Backoffice API Allows Unauthorized Modification of Domain Data](https://junglewise.ai/threats/cve-2026-31832-umbraco-backoffice-api-allows-unauthorized-modification-of-domain)