Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

概要

参考情報

• umbraco/Umbraco-CMS security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-46736 · ADVISORY
• umbraco/Umbraco-CMS commit 14fbd20 · WEB
• umbraco/Umbraco-CMS commit 34709be · WEB
• umbraco/Umbraco-CMS · PACKAGE

Umbraco.Cms のその他の脆弱性

• CVE-2026-69197高 8.7Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the dir…
• CVE-2026-46616中 6.1Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member relate…
• CVE-2026-46609中 4.6Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, wh…
• CVE-2026-31834高 7.2Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS.…
• CVE-2026-31833中 6.7Umbraco is an ASP.NET CMS. From 16.2.0 to before 16.5.1 and 17.2.2, An authenticated backoffice user with access to Settings can inject mali…