Description
Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. The issue allows low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to the settings section. Version 14.3.0 contains a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| umbraco | Umbraco-CMS | >= 14.0.0, < 14.3.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Umbraco.CMS | >= 14.0.0, < 14.3.0 | 14.3.0 | GHSA-4gp9-ff99-j6vj |