CVE-2026-27449: 
C# vulnerability analysis and mitigation

CVE-2026-27449 is a missing authentication and improper access control vulnerability in Umbraco Engage (the Umbraco.Engage.Forms NuGet package), a business intelligence and analytics platform built on Umbraco CMS. Certain API endpoints are exposed without enforcing authentication or authorization checks, allowing unauthenticated network attackers to retrieve sensitive data by supplying user-controlled identifier parameters. Affected versions include v16.0.0–16.2.0 and v17.0.0–17.1.0; patched versions are 16.2.1 and 17.1.1. The vulnerability was published on February 26, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Umbraco Advisory).

The root cause is a combination of three weaknesses: CWE-284 (Improper Access Control), CWE-306 (Missing Authentication for Critical Function), and CWE-639 (Authorization Bypass Through User-Controlled Key). Affected API endpoints perform no session validation or credential checks before processing requests, and they accept a user-supplied identifier parameter (e.g., ?id=<value>) to look up and return records. Because identifiers are predictable or enumerable, an attacker can iterate over them to extract data at scale without any authentication. No special privileges, user interaction, or complex conditions are required — the attack is executable directly over the network against any exposed Umbraco Engage instance (GitHub Advisory, Umbraco Advisory).

Successful exploitation results in high confidentiality impact, with no integrity or availability impact identified. An unauthenticated attacker can enumerate and extract sensitive Engage-managed data at scale, which may include analytics data, visitor tracking data, customer-related information, and other content managed by the platform. The exact scope of exposed data depends on the deployment configuration, but the ability to iterate over all records means bulk data exfiltration is feasible. No lateral movement or code execution capability has been identified as part of this vulnerability (GitHub Advisory, Umbraco Advisory).

1. Reconnaissance: Identify internet-facing Umbraco CMS deployments with the Umbraco Engage package installed (versions 16.0.0–16.2.0 or 17.0.0–17.1.0) using tools such as Shodan, Censys, or passive DNS enumeration. Look for NuGet package references or Umbraco-specific URL patterns.
2. Identify vulnerable API endpoints: Probe the target for Umbraco Engage API endpoints that accept an ?id= parameter. These endpoints do not require authentication and are accessible directly over HTTP/HTTPS.
3. Send unauthenticated request: Issue a direct HTTP GET request to a vulnerable endpoint with a known or guessed identifier, e.g., GET /umbraco/engage/api/someendpoint?id=1. No session cookie, API key, or authentication header is required.
4. Enumerate records: Iterate over sequential or predictable identifier values (e.g., ?id=1, ?id=2, ...) using a scripted loop or tool such as curl, ffuf, or a custom script to extract all accessible records.
5. Exfiltrate data: Collect and store the returned data, which may include analytics records, visitor tracking information, customer data, or other Engage-managed content, depending on the deployment (GitHub Advisory, Umbraco Advisory).

• Network: High volume of unauthenticated HTTP GET requests to Umbraco Engage API endpoints (e.g., paths containing /umbraco/engage/) with sequential or incrementing ?id= parameter values from a single or small set of source IPs.
• Logs: Web server or application access logs showing repeated requests to Engage API endpoints without associated authentication tokens or session cookies; rapid sequential enumeration of numeric ID values in query strings.
• Logs: Anomalous spikes in API response data volume from unauthenticated sessions in Umbraco or IIS/Kestrel access logs.
• Network: Outbound data transfers to unfamiliar external IP addresses following a burst of API enumeration activity.

Umbraco has released patched versions addressing this vulnerability: 16.2.1 for v16 deployments and 17.1.1 for v17 deployments. Users should upgrade to the appropriate patched version immediately via NuGet. No configuration-based workarounds are available for unpatched systems. Given that the vulnerability is network-accessible and requires no authentication, organizations should treat patching as a high priority, particularly for internet-facing deployments (GitHub Advisory, Umbraco Advisory).

The advisory was published by Umbraco contributor Amalie-Wowern on February 26, 2026, and was reviewed and added to the GitHub Advisory Database on February 27, 2026. No significant independent researcher commentary, media coverage, or notable social media discussion beyond automated CVE tracking feeds has been identified for this vulnerability.