An unauthenticated attacker can supply the '?expand' query parameter in a request for a public node to force the API to serialize and disclose the full property values of linked protected content. While a direct request to the protected node correctly returns a 401 Unauthorized status, the expansion mechanism exposes the internal properties, routes, and identifiers of member-gated data. This affects Umbraco CMS versions 12.0.0 through 13.15.0, 14.0.0 through 17.5.2, and 18.0.0 through 18.0.1.

Impact

Successful exploitation allows unauthorized retrieval of sensitive, member-gated information such as pricing structures, internal documentation, and restricted articles. The impact is highest when the Delivery API is configured for public access, though it remains exploitable in environments gated by API keys if the attacker possesses legitimate access to a public node that references protected content.

Recommendation

Prioritized, concrete actions for security operations and IT teams:

• Upgrade Umbraco CMS to version 13.15.1, 17.5.3, or 18.0.2 to address CVE-2026-69197.
• Audit Delivery API logs for high-frequency use of the '?expand' query parameter across public nodes to identify potential enumeration or data exfiltration attempts.
• Review Content Picker configurations to identify nodes that reference sensitive, member-gated content, and restrict API access to these paths until patching is complete.