CVE-2023-37267

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.

• CWE-284

• https://github.com/umbraco/Umbraco-CMS/commit/1f26f2c6f3428833892cde5c6d8441fb041e410ePatch
• https://github.com/umbraco/Umbraco-CMS/commit/20a4e475c8d7b91d263e4e103ef19f3644e7b569Patch
• https://github.com/umbraco/Umbraco-CMS/commit/82eae48d098b9deecbdf86cf288b2b18020e1fedPatch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-h8wc-r4jh-mg7mVendor Advisory
• https://github.com/umbraco/Umbraco-CMS/commit/1f26f2c6f3428833892cde5c6d8441fb041e410ePatch
• https://github.com/umbraco/Umbraco-CMS/commit/20a4e475c8d7b91d263e4e103ef19f3644e7b569Patch
• https://github.com/umbraco/Umbraco-CMS/commit/82eae48d098b9deecbdf86cf288b2b18020e1fedPatch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-h8wc-r4jh-mg7mVendor Advisory

Published

Jul 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37261OpenComputers is a Minecraft mod that adds programmable comp…8.8
• CVE-2023-37262CC: Tweaked is a mod for Minecraft which adds programmable c…8.8
• CVE-2023-37263Strapi is the an open-source headless content management sys…2.7
• CVE-2023-37264Tekton Pipelines project provides k8s-style resources for de…4.3
• CVE-2023-37265CasaOS is an open-source Personal Cloud system. Due to a lac…9.8
• CVE-2023-37266CasaOS is an open-source Personal Cloud system. Unauthentica…9.8
• CVE-2023-37268Warpgate is an SSH, HTTPS and MySQL bastion host for Linux t…8.8
• CVE-2023-37269Winter is a free, open-source content management system (CMS…4.8
• CVE-2023-3727Use after free in WebRTC in Google Chrome prior to 115.0.579…8.8
• CVE-2023-37270Piwigo is open source photo gallery software. Prior to versi…8.8
• CVE-2023-37271RestrictedPython is a tool that helps to define a subset of …9.9
• CVE-2023-37272JS7 is an Open Source Job Scheduler. Users specify file name…5.4