CVE-2026-31832: 
C# vulnerability analysis and mitigation

CVE-2026-31832 is a broken object-level authorization (BOLA) vulnerability in Umbraco CMS, an ASP.NET-based content management system. It affects versions 14.0.0 through before 16.5.1 and 17.0.0 through before 17.2.2 of the Umbraco.Cms NuGet package. The flaw allows authenticated backoffice users to assign domain-related data to content nodes they are not authorized to access, bypassing user group privileges or start node restrictions. It was published on March 10, 2026, with patches released the same day. The CVSS v3.1 base score is 5.4 (Medium) (GitHub Advisory, Umbraco Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the backoffice API endpoint responsible for setting domain configurations on content nodes fails to enforce proper authorization checks. An authenticated attacker with low-level backoffice access can craft API calls that reference content node identifiers they do not have permission to manage — either through user group restrictions or start node boundaries — and successfully assign domain data to those nodes. The vulnerability requires network access, low privileges, no user interaction, and low attack complexity, making it straightforward to exploit for any authenticated backoffice user (GitHub Advisory, Umbraco Advisory).

Successful exploitation allows an authenticated attacker to modify domain configurations for content nodes they are not permitted to edit, resulting in low integrity and low availability impacts with no direct confidentiality breach. Practical consequences include malicious or unintended routing behavior across the CMS, potential service disruption, and indirect disclosure of configuration-related information. While the vulnerability does not enable remote code execution or direct data exfiltration, unauthorized domain reassignment could be leveraged to redirect site traffic or disrupt content delivery for affected Umbraco installations (Umbraco Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036–0.056%, placing it in the 18th percentile for exploitation probability within 30 days. No threat actor attribution has been reported. The low privilege requirement (any authenticated backoffice user) does lower the barrier for exploitation by insider threats or compromised editor accounts.

1. Obtain backoffice credentials: Acquire valid Umbraco backoffice credentials with any level of editor access — this could be through phishing, credential stuffing, or a compromised low-privilege account.
2. Authenticate to the backoffice API: Log in to the Umbraco backoffice and obtain a valid authentication token or session cookie for use in API calls.
3. Identify target content node IDs: Enumerate content node identifiers (e.g., GUIDs or integer IDs) for nodes outside the attacker's permitted scope, which may be discoverable through the CMS interface or API responses.
4. Craft unauthorized API request: Send an authenticated HTTP request to the backoffice domain assignment API endpoint, supplying the target content node ID and desired domain data in the request body — bypassing the authorization check that should restrict access to permitted nodes only.
5. Achieve unauthorized domain modification: The API processes the request without validating whether the authenticated user has permission over the specified content node, resulting in the domain configuration being applied to the unauthorized node (Umbraco Advisory, GitHub Advisory).

• Network: Authenticated API requests to the Umbraco backoffice domain assignment endpoint referencing content node IDs outside the requesting user's permitted start nodes or user group scope.
• Logs: Umbraco backoffice audit logs showing domain assignment operations performed by low-privilege editor accounts on content nodes they do not normally manage; repeated API calls to domain-related endpoints from a single user account targeting multiple node IDs.
• Application Behavior: Unexpected changes to domain routing configurations in the Umbraco CMS; content nodes with domain assignments that do not align with the responsible editor's access scope.

Umbraco has released patches in versions 16.5.1 and 17.2.2, which enforce proper authorization checks on the affected backoffice API endpoint. All installations running versions 14.0.0 through 16.5.0 or 17.0.0 through 17.2.1 should upgrade immediately. There is no configuration-based workaround available — upgrading is the only remediation. As an interim measure, administrators should review and restrict backoffice user group privileges and start node assignments to minimize the blast radius of any exploitation attempt (Umbraco Advisory, GitHub Advisory).