Umbraco Delivery API Authorization Bypass via Node Expansion

Umbraco CMS contains a critical authorization bypass vulnerability, tracked as CVE-2026-69197, affecting the Content Delivery API. The vulnerability stems from a flaw in the controller-layer access validation, which only enforces member-gated (Public Access) protections when a protected node is requested directly. When a publicly accessible (unprotected) node references a protected node via a Content Picker, Multi-Node Tree Picker, or nested block structures, the Delivery API fails to propagate access checks during expansion.

An unauthenticated attacker can supply the '?expand' query parameter in a request for a public node to force the API to serialize and disclose the full property values of linked protected content. While a direct request to the protected node correctly returns a 401 Unauthorized status, the expansion mechanism exposes the internal properties, routes, and identifiers of member-gated data. This affects Umbraco CMS versions 12.0.0 through 13.15.0, 14.0.0 through 17.5.2, and 18.0.0 through 18.0.1.

Impact

Successful exploitation allows unauthorized retrieval of sensitive, member-gated information such as pricing structures, internal documentation, and restricted articles. The impact is highest when the Delivery API is configured for public access, though it remains exploitable in environments gated by API keys if the attacker possesses legitimate access to a public node that references protected content.

Recommendation

Prioritized, concrete actions for security operations and IT teams:

• Upgrade Umbraco CMS to version 13.15.1, 17.5.3, or 18.0.2 to address CVE-2026-69197.
• Audit Delivery API logs for high-frequency use of the '?expand' query parameter across public nodes to identify potential enumeration or data exfiltration attempts.
• Review Content Picker configurations to identify nodes that reference sensitive, member-gated content, and restrict API access to these paths until patching is complete.