CVE-2024-32872
Umbraco Workflow's Backoffice users can execute arbitrary SQL
Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Umbraco Workflow's Backoffice users can execute arbitrary SQL
Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.
- Record
CVE-2024-32872- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2024-1056
Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.
- Record
EUVD-2024-1056- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-287f-46j7-j4wh
Umbraco Workflow's Backoffice users can execute arbitrary SQL
Impact
Backoffice users can execute arbitrary SQL.
Explanation of the vulnerability
A Backoffice user can modify requests to a particular API endpoint to include SQL which will be executed by the server.
Affected versions
All versions
Patches
Workflow 10.3.9, 12.2.6, 13.0.6, Plumber 10.1.2
References
- Record
GHSA-287f-46j7-j4wh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.
- Record
CVE-2024-32872- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-287f-46j7-j4wh
Umbraco Workflow's Backoffice users can execute arbitrary SQL
Impact
Backoffice users can execute arbitrary SQL.
Explanation of the vulnerability
A Backoffice user can modify requests to a particular API endpoint to include SQL which will be executed by the server.
Affected versions
All versions
Patches
Workflow 10.3.9, 12.2.6, 13.0.6, Plumber 10.1.2
References
- Record
GHSA-287f-46j7-j4wh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Umbraco.WorkflowNuGet |
before 10.3.9 | 10.3.9 |
Umbraco.WorkflowNuGet |
11.0.0-rc1 up to 12.2.6 | 12.2.6 |
Umbraco.WorkflowNuGet |
13.0.0-rc1 up to 13.0.6 | 13.0.6 |
Plumber.WorkflowNuGet |
before 10.1.2 | 10.1.2 |
Umbraco.WorkflowNuGet |
before 10.3.9, plus listed versions 10.0.010.1.010.1.0-rc110.1.110.1.2 Show 15 moreShow less10.2.010.2.0-rc110.2.110.2.210.2.310.3.010.3.0-rc110.3.110.3.210.3.310.3.410.3.510.3.610.3.710.3.8 |
10.3.9 |
Umbraco.WorkflowNuGet |
11.0.0-rc1 up to 12.2.6, plus listed versions 11.0.011.0.0-rc211.0.0-rc311.0.111.1.0 Show 28 moreShow less11.1.0-rc111.1.111.1.211.2.011.2.0-rc111.2.111.2.211.2.311.3.011.3.0-rc111.3.111.3.212.0.012.0.0-rc112.0.0-rc212.0.0-rc412.0.112.1.012.1.0-rc112.1.112.1.212.2.012.2.0-rc112.2.112.2.212.2.312.2.412.2.5 |
12.2.6 |
Umbraco.WorkflowNuGet |
13.0.0-rc1 up to 13.0.6, plus listed versions 13.0.013.0.0-rc213.0.113.0.213.0.313.0.5 |
13.0.6 |
Plumber.WorkflowNuGet |
before 10.1.2, plus listed versions 1.0.01.0.0-alpha-0002301.0.11.0.21.0.3 Show 45 moreShow less1.0.41.0.51.0.61.0.71.1.01.1.11.1.21.1.2-beta-0003141.1.31.1.3-beta-0003151.1.3-beta-0003181.1.3-beta-0003191.1.3-beta-0003291.1.4-beta-0003331.2.01.2.0-beta-0003391.2.0-beta-0003401.2.0-beta-0003411.2.0-beta-0003421.2.0-beta-0003431.2.0-beta-0003441.2.0-beta-0003451.2.0-beta-0003461.2.0-beta-0003491.2.0-beta-0003501.2.0-beta-0003511.2.0-beta-0003551.2.0-beta-0003561.2.0-beta-0003571.2.0-beta-0003591.2.0-beta-0003601.2.0-beta-0003631.2.11.2.1-beta-0003651.2.1-beta-0003661.2.1-beta-0003671.2.1-beta-0003681.2.1-beta-0003711.2.2-beta-0003721.3.01.3.0-beta-0003751.3.11.3.1-beta-0003771.3.21.3.3 |
10.1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-32872 is a medium vulnerability (CVSS 5.5) in Umbraco Umbraco.workflow.issues, published April 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in Umbraco.Workflow 10.3.9.
References
Left out here: 169 versions. The JSON record has them.