---
title: "Is your Umbraco site at risk? One link can hand over an admin session"
description: "On October 27 Umbraco published seven security advisories. The worst is a chain that hands a back-office session to an attacker when a signed-in user opens his link. Fixed in 17.7.2 and 18.2.2."
url: https://ihsanalapsi.dev/articles/umbraco-backoffice-takeover-fix
lang: en
date: 2026-10-28
updated: 2026-10-28
tags: ["Security updates", "App security"]
author: Ihsan Alapsi (إحسان العبسي)
---
# Is your Umbraco site at risk? One link can hand over an admin session

If your site runs on Umbraco CMS, there is a link that, opened by someone on your team while signed in to the back-office, hands their session to an attacker. By the end of this article you will know whether your site is exposed, what to update, and what to configure if the update takes time.

## What did Umbraco fix on October 27?

On October 27, 2026 Umbraco published seven security advisories for Umbraco CMS, all fixed in versions 17.7.2 and 18.2.2. One is rated high, the rest moderate or low.

The back-office is the interface your team signs in to for editing content, users and settings. Here is how the advisories split:


| Advisory            | What it does                                                               | Severity |
| ------------------- | -------------------------------------------------------------------------- | -------- |
| GHSA-rpv9-qp4c-g469 | Back-office account takeover through sign-in redirect manipulation         | High     |
| GHSA-r4qv-c8pg-qq59 | A user grants a user group start nodes outside their own access            | Moderate |
| GHSA-88p9-4pxf-pq3c | Stored XSS chained with path traversal in media management                 | Moderate |
| GHSA-4qmm-fhgv-vq9g | Signing out does not end the session on the server                         | Moderate |
| GHSA-24m3-86rh-6888 | Unpublished content exposed through preview and the Delivery API           | Moderate |
| GHSA-xqwv-jvcm-5vjq | Start-node restrictions not enforced on URL, imaging and reference lookups | Moderate |
| GHSA-4vcm-wj6q-3pmg | Website preview session did not expire                                     | Low      |


The same day Umbraco released 13.16.3 for version 13, with the start node bypass fix only.

## How does one link hand over a back-office session?

Advisory GHSA-rpv9-qp4c-g469 describes several weaknesses in the back-office sign-in flow that, combined, pass a user's session to the attacker. It is rated 8.8 on CVSS 3.1.

The attacker prepares the attack without an account and sends a link. If a back-office user who is signed in opens it, the attacker gets an authenticated session with that user's privileges. For an administrator that means full control of the back-office: content, users and configuration, and, according to the advisory, potentially code execution on the server through administrator features.

## Is my site exposed?

Your site is exposed to the full chain if the web server or hosting passes requests for host names that are not yours on to Umbraco. The advisory says this is common in three setups:

1. Umbraco running on Kestrel directly.
2. IIS without host name bindings.
3. A reverse proxy that forwards the Host header unchanged.

A site where only the expected host names reach the application is not exposed to the full chain. That does not replace the update, because the other advisories have nothing to do with host names.

## What if you can't update today?

The advisory says no configuration setting resolves the flaw, but three things reduce the risk until you update:

1. Restrict the host names that reach the application: set `AllowedHosts` in `appsettings.json` to your site's host names separated by semicolons, or bind the web server or reverse proxy to explicit host names so other hosts are rejected before they reach Umbraco.
2. Tell your team not to open back-office links from untrusted sources while signed in.
3. Open the `umbracoOpenIddictApplications` table and review the redirect URIs for `umbraco-back-office` and `umbraco-swagger`. Any host name that is not yours is a sign of tampering.

```json
{
  "AllowedHosts": "example.com;admin.example.com"
}
```

If you are updating the whole server, also see the [.NET out-of-band updates](/articles/dotnet-october-2026-oob-updates) we covered this month.

## Why are sign-out and preview on the list too?

Because both let a stolen session live longer than you would expect. According to advisory GHSA-4qmm-fhgv-vq9g, signing out only cleared the cookie in the browser, and a cookie copied before sign-out stayed valid until it expired.

The website preview token never expired and stayed valid even after a password change, until the account was disabled, locked out or deleted (GHSA-4vcm-wj6q-3pmg). We covered a similar story of permissions growing from inside the dashboard in a WordPress plugin: [a contributor who promotes themselves to editor](/articles/ablocks-contributor-editor-escalation).

## Where do you start now?

Update first, then shut out unknown host names, and check whether anyone tampered with the sign-in settings.

1. Open your project file and check the version of the `Umbraco.Cms` package.
2. On 17, update to 17.7.2; on 18, to 18.2.2.
3. On 13, update to 13.16.3 or later.
4. Set `AllowedHosts` even after the update, so only your own host names reach the application.
5. Check the `umbracoOpenIddictApplications` table for unknown host names, and disable any account whose preview token you suspect has leaked.

If you want someone to test your back-office and sign-in flow the way an attacker would, that is the job of [Muhassan](/muhassan).

All the security updates we have written about are in one place: [security updates](/articles?tag=security-updates).

## FAQ

**Does the attacker need an account on my site?**

No. Preparing the attack needs no account, but a back-office user who is signed in has to open the attacker's link to complete the chain.

**Is the update enough on its own?**

Yes for the high-severity flaw. Versions 17.7.2 and 18.2.2 only accept sign-in redirects to the serving host or explicitly configured hosts, and the advisory says this also protects sites whose stored sign-in configuration was tampered with before the upgrade.

**What about Umbraco 13?**

Umbraco released 13.16.3 the same day with one security fix: the start node restriction bypass, where a user grants a user group access wider than their own.

**Does changing the password stop a stolen preview token?**

No. The advisory says the preview token stayed valid after a password change, and disabling, locking out or deleting the account is what invalidates it until you update.