Umbraco CMS Broken Object-Level Authorization Vulnerability in Backoffice API

A broken object-level authorization vulnerability has been identified in Umbraco CMS versions 14.0.0 prior to 16.5.1 and 17.2.2. This vulnerability exists in a backoffice API endpoint, allowing authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue arises from insufficient authorization enforcement, enabling editors to set domains on content nodes they do not have permission to access, either through user group privileges or start nodes.

Impact

Exploitation of this vulnerability allows unauthorized modification of domain configurations for content nodes, potentially leading to malicious or unintended routing behavior, service disruption, and disclosure of configuration-related information.

Remediation

Users can upgrade to Umbraco CMS versions 16.5.1 or 17.2.2 to address this vulnerability.