Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-69197 · Microsoft / collected KEV context

EUVD-2026-81902

GHSA-wr57-hqmp-fgvh

cve-program · CVE-2026-69197

• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh
• https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe
• https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511
• https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2

euvd · EUVD-2026-81902

• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh
• https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe
• https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511
• https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2

nvd · CVE-2026-69197

• https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe
• https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511
• https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh

osv · GHSA-wr57-hqmp-fgvh

• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wr57-hqmp-fgvh
• https://github.com/umbraco/Umbraco-CMS/commit/26312a3f717a0f33bb3d7d28b14bef3592bdb0fe
• https://github.com/umbraco/Umbraco-CMS/commit/5360e2a9681ce2d0024be374e80339260bcc2511
• https://github.com/umbraco/Umbraco-CMS/commit/a9649da4e5a0786db7688bd6b5036a21df26b015
• https://github.com/umbraco/Umbraco-CMS
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-13.15.1
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.5.3
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.0.2

No related operational record is retained in the current change model.