{"id":"CVE-2023-37267","aliases":["EUVD-2023-2073","GHSA-h8wc-r4jh-mg7m"],"status":"published","title":"Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions","description":"Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00715,"percentile":0.54055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2023-07-13T13:43:59Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"NuGet","package":"Umbraco.Cms.Infrastructure","fixed_in":["10.6.1","11.4.2","12.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"Umbraco.Cms.Web.BackOffice","fixed_in":["10.6.1","11.4.2","12.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms.Infrastructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"10.6.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms.Infrastructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.4.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms.Infrastructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.0"},{"fixed":"12.0.1"}]}],"versions":["12.0.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms.Web.BackOffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"10.6.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms.Web.BackOffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.4.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"Umbraco.Cms.Web.BackOffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.0"},{"fixed":"12.0.1"}]}],"versions":["12.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms.Infrastructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"10.6.1"}]}],"versions":["10.0.0","10.0.0-rc5","10.0.1","10.1.0","10.1.0-rc","10.1.0-rc2","10.1.1","10.2.0","10.2.0-rc","10.2.1","10.3.0","10.3.0-rc","10.3.1","10.3.2","10.4.0","10.4.0-rc","10.4.1","10.4.2","10.5.0","10.5.0-rc","10.5.1","10.6.0","10.6.0-rc","9.0.0","9.0.1","9.1.0","9.1.0-rc","9.1.1","9.1.2","9.2.0","9.2.0-rc","9.3.0","9.3.0-rc","9.3.1","9.4.0","9.4.0-rc","9.4.1","9.4.2","9.4.3","9.5.0","9.5.0-rc","9.5.0-rc2","9.5.0-rc3","9.5.1","9.5.2","9.5.3","9.5.4"]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms.Infrastructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.4.2"}]}],"versions":["11.0.0","11.1.0","11.1.0-rc","11.2.0","11.2.0-rc","11.2.1","11.2.2","11.3.0","11.3.0-rc","11.3.1","11.4.0","11.4.0-rc","11.4.1"]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms.Infrastructure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.1"}]}],"versions":["12.0.0"]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms.Web.BackOffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"10.6.1"}]}],"versions":["10.0.0","10.0.0-rc1","10.0.0-rc2","10.0.0-rc3","10.0.0-rc4","10.0.0-rc5","10.0.1","10.1.0","10.1.0-rc","10.1.0-rc2","10.1.1","10.2.0","10.2.0-rc","10.2.1","10.3.0","10.3.0-rc","10.3.1","10.3.2","10.4.0","10.4.0-rc","10.4.1","10.4.2","10.5.0","10.5.0-rc","10.5.1","10.6.0","10.6.0-rc","9.0.0","9.0.1","9.1.0","9.1.0-rc","9.1.1","9.1.2","9.2.0","9.2.0-rc","9.3.0","9.3.0-rc","9.3.1","9.4.0","9.4.0-rc","9.4.1","9.4.2","9.4.3","9.5.0","9.5.0-rc","9.5.0-rc2","9.5.0-rc3","9.5.1","9.5.2","9.5.3","9.5.4"]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms.Web.BackOffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.4.2"}]}],"versions":["11.0.0","11.1.0","11.1.0-rc","11.2.0","11.2.0-rc","11.2.1","11.2.2","11.3.0","11.3.0-rc","11.3.1","11.4.0","11.4.0-rc","11.4.1"]},{"source":"osv","ecosystem":"NuGet","package":"Umbraco.Cms.Web.BackOffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.1"}]}],"versions":["12.0.0"]}],"products":[{"vendor":"umbraco","product":"umbraco-cms"},{"vendor":"umbraco","product":"umbraco_cms"}],"references":[{"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-h8wc-r4jh-mg7m","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/1f26f2c6f3428833892cde5c6d8441fb041e410e","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/20a4e475c8d7b91d263e4e103ef19f3644e7b569","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/82eae48d098b9deecbdf86cf288b2b18020e1fed","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37267","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h8wc-r4jh-mg7m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37267.json","tags":["advisory"]},{"url":"https://github.com/umbraco/Umbraco-CMS","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-37267","title":"Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions","description":"Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.","status":"published","published":"2023-07-13T13:43:59.383Z","modified":"2024-10-31T17:46:06.482Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:16.126506Z"}],"euvd":[{"id":"EUVD-2023-2073","description":"Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.","status":"published","published":"2023-07-13T13:43:59Z","modified":"2024-10-31T17:46:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:05:13.001555Z"}],"ghsa":[{"id":"GHSA-h8wc-r4jh-mg7m","title":"Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions","description":"Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions.\n\n### Impact\nAn unauthorized user gaining admin-level access and permissions to the backoffice.\n\n### Patches\n10.6.1, 11.4.2, 12.0.1\n\n### Workarounds\n* Enabling the [Unattended Install](https://docs.umbraco.com/umbraco-cms/reference/configuration/unattendedsettings) feature will mean the vulnerability is not exploitable.\n* Enabling IP restrictions to `*/install/*` and `*/umbraco/*` will limit the exposure to allowed IP addresses.\n","status":"published","published":"2023-07-13T17:02:07Z","modified":"2023-11-04T05:02:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:12.407027Z"}],"nvd":[{"id":"CVE-2023-37267","description":"Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.","status":"published","published":"2023-07-13T14:15:09.427Z","modified":"2026-06-17T06:07:51.103Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:08:15.91037Z"}],"osv":[{"id":"CVE-2023-37267","title":"Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions","description":"Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.","status":"published","published":"2023-07-13T13:43:59.383Z","modified":"2026-11-11T10:30:34.304689958Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-11T11:06:25.198583Z"},{"id":"GHSA-h8wc-r4jh-mg7m","title":"Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions","description":"Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions.\n\n### Impact\nAn unauthorized user gaining admin-level access and permissions to the backoffice.\n\n### Patches\n10.6.1, 11.4.2, 12.0.1\n\n### Workarounds\n* Enabling the [Unattended Install](https://docs.umbraco.com/umbraco-cms/reference/configuration/unattendedsettings) feature will mean the vulnerability is not exploitable.\n* Enabling IP restrictions to `*/install/*` and `*/umbraco/*` will limit the exposure to allowed IP addresses.\n","status":"published","published":"2023-07-13T17:02:07Z","modified":"2024-02-16T07:58:25.940145Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}