An authorization bypass vulnerability in the Umbraco CMS Content Delivery API allows unauthorized users to retrieve sensitive content from protected nodes, posing a significant risk to data confidentiality.

This is an authorization bypass flaw occurring in the Content Delivery API. It allows unauthenticated remote attackers to access sensitive node data, such as names and property values, by leveraging the ?expand parameter on unprotected referencing nodes, thereby circumventing established Public Access or API key restrictions.

The vulnerability facilitates unauthorized disclosure of sensitive information stored within the CMS, potentially exposing private content intended only for authenticated members or restricted user groups. Given the CVSS score of 8.7, this flaw represents a high risk to organizational data privacy, which could lead to regulatory compliance issues and loss of stakeholder trust.

Immediate Action: Upgrade Umbraco CMS to version 13.15.1, 17.5.3, or 18.0.2 respectively to ensure the Content Delivery API correctly enforces authorization checks on referenced nodes.

Proactive Monitoring: Review web server and application logs for suspicious access patterns, specifically monitoring for frequent or unusual use of the ?expand parameter in API requests.

Compensating Controls: Implement WAF rules to inspect and block requests that utilize the ?expand parameter if the API is not intended to be publicly accessible, or restrict access to the Content Delivery API at the network level.

Public Exploit Available: No

Organizations must prioritize the application of the vendor-provided patches as soon as possible. Because this vulnerability allows for the unauthorized retrieval of data without requiring valid credentials, the risk to sensitive information is substantial. Administrators should move quickly to update the affected CMS instances to the specified versions to eliminate the underlying authorization logic error.