CVE-2026-69197

Name of the Vulnerable Software and Affected Versions Umbraco versions prior to 13.15.1 Umbraco versions prior to 17.5.3 Umbraco versions prior to 18.0.2

Description The Content Delivery API fails to apply member and Public Access checks to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including those nested in Block List, Block Grid, or Rich Text Editor blocks. While direct requests for protected nodes are correctly blocked, an unauthorized caller can retrieve a protected node's name, route, and id through an unprotected referencing node. By using the ?expand parameter, the caller can further retrieve full property values of the protected node. This bypass occurs whether the API is publicly accessible via DeliveryApi:PublicAccess or gated by an organization-wide API key. Additionally, the RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy paths bypass restrictions based on allowed or disallowed content-type aliases for referenced content. This leads to the disclosure of confidential, member-gated content such as pricing, internal documents, or gated articles.

Recommendations Update to version 13.15.1 or newer. Update to version 17.5.3 or newer. Update to version 18.0.2 or newer.