CVE-2023-49273

Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue.

• CWE-863

• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-cfr5-7p54-4qg8Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-cfr5-7p54-4qg8Vendor Advisory

Published

Dec 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49262The authentication mechanism can be bypassed by overflowing …9.8
• CVE-2023-49269Hotel Management v1.0 is vulnerable to multiple authenticate…5.4
• CVE-2023-4927Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-49270Hotel Management v1.0 is vulnerable to multiple authenticate…5.4
• CVE-2023-49271Hotel Management v1.0 is vulnerable to multiple authenticate…5.4
• CVE-2023-49272Hotel Management v1.0 is vulnerable to multiple authenticate…5.4
• CVE-2023-49274Umbraco is an ASP.NET content management system (CMS). Start…5.3
• CVE-2023-49275Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2023-49276Uptime Kuma is an open source self-hosted monitoring tool. I…6.1
• CVE-2023-49277dpaste is an open source pastebin application written in Pyt…6.1
• CVE-2023-49278Umbraco is an ASP.NET content management system (CMS). Start…5.3
• CVE-2023-49279Umbraco is an ASP.NET content management system (CMS). Start…5.4