CVE-2026-69197: 
C# vulnerability analysis and mitigation

CVE-2026-69197 is an authorization bypass vulnerability in Umbraco CMS's Content Delivery API that allows unauthenticated callers to access member-gated (Public Access) content through property expansion of referenced nodes. The flaw affects Umbraco.Cms versions >= 12.0.0 < 13.15.1, >= 14.0.0-rc1 < 17.5.3, and >= 18.0.0 < 18.0.2. It was published on September 17, 2026, with the GitHub Security Advisory (GHSA-wr57-hqmp-fgvh) credited to finder "suryadina." It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is a missing authorization check (CWE-862) combined with exposure of sensitive information to unauthorized actors (CWE-200) in the ElementOnlyOutputExpansionStrategy and RequestContextOutputExpansionStrategyV2 classes. The Content Delivery API enforces Public Access protection only at the controller layer for the directly requested node; when a public node references a protected node via a Content Picker or Multi-Node Tree Picker (including those nested in Block List, Block Grid, or Rich Text Editor blocks), the expansion logic serializes the protected node without invoking IRequestMemberAccessService.MemberHasAccessToAsync(). An attacker can retrieve a protected node's name, route, and ID without any expansion, and use the ?expand query parameter to retrieve full property values of the protected node through the unprotected referencing node. The same expansion path also bypasses content-type alias allow/deny restrictions for referenced content (GitHub Advisory, Patch Commit).

Confidential, member-gated content — such as pricing pages, internal documents, or gated articles — referenced by any publicly readable node is disclosed to unauthenticated clients when DeliveryApi:PublicAccess is enabled. Even when the Delivery API is gated by an organization-wide API key, any key holder can bypass per-node Public Access restrictions through the same expansion mechanism. There is no integrity or availability impact; exploitation is limited to confidentiality loss of protected content properties (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. However, the NVD SSVC assessment marks the vulnerability as automatable (yes), meaning it can be exploited programmatically at scale without user interaction, increasing the risk for unpatched internet-facing Umbraco instances (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Umbraco CMS instances running affected versions (>= 12.0.0 < 13.15.1, >= 14.0.0-rc1 < 17.5.3, or >= 18.0.0 < 18.0.2) with the Content Delivery API enabled, using tools like Shodan or Censys searching for Umbraco-specific API endpoints (e.g., /umbraco/delivery/api/v2/content).
2. Identify unprotected nodes: Query the Delivery API for publicly accessible content nodes that contain Content Picker or Multi-Node Tree Picker properties referencing other content (e.g., GET /umbraco/delivery/api/v2/content?fetch=children:/).
3. Enumerate referenced protected nodes: Without any expansion, observe that the API response includes the name, route, and id of referenced protected nodes embedded in picker property values — even without authentication.
4. Expand to retrieve full property values: Append ?expand=properties[pickerPropertyAlias] to the request for the unprotected node (e.g., GET /umbraco/delivery/api/v2/content/item/{id}?expand=properties[relatedContent]). The API will serialize the full property values of the referenced protected node without performing a Public Access check.
5. Extract sensitive content: Parse the JSON response to extract the full content of the member-gated node, including all its properties, bypassing the 401 response that would be returned by a direct request to that node (GitHub Advisory).

• Network: Unusual or repeated GET requests to Umbraco Delivery API endpoints (e.g., /umbraco/delivery/api/v1/content or /umbraco/delivery/api/v2/content) containing ?expand= query parameters from unauthenticated sources (no Authorization or Api-Key headers); high-volume automated scanning of content endpoints.
• Logs: Web server or application logs showing requests to Delivery API endpoints with expand parameters targeting picker-type properties from anonymous clients; patterns of sequential content ID enumeration in API requests.
• Application Behavior: Protected content nodes' property data appearing in API responses for requests that do not include member authentication tokens, particularly when the response HTTP status is 200 rather than 401 for content that should be gated.

Upgrade Umbraco CMS to the patched versions: 13.15.1, 17.5.3, or 18.0.2, which add access control checks within ElementOnlyOutputExpansionStrategy and RequestContextOutputExpansionStrategyV2 to invoke IRequestMemberAccessService.MemberHasAccessToAsync() before serializing expanded referenced content (Release 13.15.1). If immediate patching is not possible, consider disabling the Content Delivery API entirely if it is not actively used, or restricting network-level access to the API endpoints. Organizations relying on API key gating should be aware that key holders can still exploit this bypass until patched (GitHub Advisory).

The advisory was published by Umbraco maintainer AndyButland on July 7, 2026, with credit to security researcher "suryadina" for discovery. Community coverage has been limited to automated vulnerability tracking platforms (VulnDB, CVEFeed, OSV) with no notable independent researcher commentary or significant social media discussion identified at the time of this report (GitHub Advisory).