{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/71454?format=json","vulnerability_id":"VCID-zm2x-n2ju-5qdp","summary":"Umbraco is an ASP.NET CMS. From 15.3.1 to before 16.5.1 and 17.2.2, A privilege escalation vulnerability has been identified in Umbraco CMS. Under certain conditions, authenticated backoffice users with permission to manage users, may be able to elevate their privileges due to insufficient authorization enforcement when modifying user group memberships. The affected functionality does not properly validate whether a user has sufficient privileges to assign highly privileged roles. This vulnerability is fixed in 16.5.1 and 17.2.2.","aliases":[{"alias":"CVE-2026-31834"},{"alias":"GHSA-rhcg-3h8r-v6vp"}],"fixed_packages":[],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/40698?format=json","purl":"pkg:nuget/Umbraco.Cms@15.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-zm2x-n2ju-5qdp"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.Cms@15.3.1"},{"url":"http://public2.vulnerablecode.io/api/packages/40669?format=json","purl":"pkg:nuget/Umbraco.Cms@17.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-42ec-2ca6-yyac"},{"vulnerability":"VCID-8sxm-wy99-cbeh"},{"vulnerability":"VCID-zm2x-n2ju-5qdp"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.Cms@17.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/397032?format=json","purl":"pkg:nuget/Umbraco.CMS@15.3.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-zm2x-n2ju-5qdp"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@15.3.1"},{"url":"http://public2.vulnerablecode.io/api/packages/397016?format=json","purl":"pkg:nuget/Umbraco.CMS@17.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-42ec-2ca6-yyac"},{"vulnerability":"VCID-8sxm-wy99-cbeh"},{"vulnerability":"VCID-zm2x-n2ju-5qdp"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/Umbraco.CMS@17.0.0"}],"references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31834","reference_id":"","reference_type":"","scores":[{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.181","published_at":"2026-06-11T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18257","published_at":"2026-06-14T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18282","published_at":"2026-06-13T12:55:00Z"},{"value":"0.00057","scoring_system":"epss","scoring_elements":"0.18262","published_at":"2026-06-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31834"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31834","reference_id":"CVE-2026-31834","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31834"},{"reference_url":"https://github.com/advisories/GHSA-rhcg-3h8r-v6vp","reference_id":"GHSA-rhcg-3h8r-v6vp","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rhcg-3h8r-v6vp"},{"reference_url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp","reference_id":"GHSA-rhcg-3h8r-v6vp","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-03-11T15:52:28Z/"}],"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rhcg-3h8r-v6vp"}],"weaknesses":[{"cwe_id":269,"name":"Improper Privilege Management","description":"The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor."},{"cwe_id":284,"name":"Improper Access Control","description":"The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor."},{"cwe_id":862,"name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":"7.0 - 8.9","exploitability":"0.5","weighted_severity":"8.0","risk_score":4.0,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zm2x-n2ju-5qdp"}