CVE-2026-69197

Umbraco CMS (ASP.NET) contains an authorization bypass in the Content Delivery API prior to 13.15.1, 17.5.3, and 18.0.2 . Member and Public Access checks are applied to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, ...