CVE-2023-49274
Umbraco CMS SMTP misconfiguration exposes potential registered user email
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Umbraco CMS SMTP misconfiguration exposes potential registered user email
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
- Record
CVE-2023-49274- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-3163
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
- Record
EUVD-2023-3163- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8qp8-9rpw-j46c
SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.
Impact
A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled
Explanation of the vulnerability
Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but do not response.
- Record
GHSA-8qp8-9rpw-j46c- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
- Record
CVE-2023-49274- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Umbraco CMS SMTP misconfiguration exposes potential registered user email
Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.
- Record
CVE-2023-49274- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-8qp8-9rpw-j46c
SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.
Impact
A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled
Explanation of the vulnerability
Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but do not response.
- Record
GHSA-8qp8-9rpw-j46c- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Umbraco.CMSNuGet |
8.0.0 up to 8.18.10 | 8.18.10 |
Umbraco.CMSNuGet |
9.0.0 up to 10.8.1 | 10.8.1 |
Umbraco.CMSNuGet |
11.0.0 up to 12.3.4 | 12.3.4 |
Umbraco.CMSNuGet |
9.0.0 up to 10.8.1, plus listed versions 10.0.010.0.0-rc110.0.0-rc210.0.0-rc310.0.0-rc4 Show 45 moreShow less10.0.0-rc510.0.110.1.010.1.0-rc10.1.0-rc210.1.110.2.010.2.0-rc10.2.110.3.010.3.0-rc10.3.110.3.210.4.010.4.0-rc10.4.110.4.210.5.010.5.0-rc10.5.110.6.010.6.0-rc10.6.110.7.010.7.0-rc10.8.010.8.0-rc9.0.19.1.09.1.0-rc9.1.19.1.29.2.09.2.0-rc9.3.09.3.0-rc9.3.19.4.09.4.0-rc9.4.19.4.29.4.39.5.09.5.0-rc9.5.0-rc2 |
10.8.1 |
Umbraco.CMSNuGet |
11.0.0 up to 12.3.4, plus listed versions 11.1.011.1.0-rc11.2.011.2.0-rc11.2.1 Show 28 moreShow less11.2.211.3.011.3.0-rc11.3.111.4.011.4.0-rc11.4.111.4.211.5.011.5.0-rc12.0.012.0.0-rc112.0.0-rc212.0.0-rc312.0.0-rc412.0.0-rc512.0.112.1.012.1.0-rc12.1.112.1.212.2.012.2.0-rc12.3.012.3.0-rc12.3.112.3.212.3.3 |
12.3.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-49274 is a low vulnerability (CVSS 3.7) in Umbraco Cms, published December 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in Umbraco.CMS 8.18.10.
References
Left out here: 5 versions. The JSON record has them.