GHSA-q3v2-xj35-9grx

Summary

Umbraco.AI discloses sensitive application configuration values

Severity

medium

CVSS

4.9

CWE

CWE-200

Published

2026-07-14

Updated

2026-07-14

Advisory details

Impact

Under certain configurations, a user with elevated privileges may be able to cause sensitive application configuration values, potentially including secret material such as credentials, to be disclosed. Successful exploitation could expose confidential information and, depending on what the affected installation stores in configuration, enable further compromise. Exploitation requires access to the AI section of the backoffice and a specific custom AI provider, which limits real-world exposure.

Patches

Patched in 1.14.0

Workarounds

Since the patch is a breaking change and requires a version jump, it is not recommended to try and implement a workaround.

Resources

• Announcement Blog Post: https://umbraco.com/blog/security-advisory-june-4-2026-security-patch-for-umbracoai-is-now-available/

References

• https://github.com/advisories/GHSA-q3v2-xj35-9grx
• https://github.com/umbraco/Umbraco.AI/security/advisories/GHSA-q3v2-xj35-9grx
• https://github.com/umbraco/Umbraco.AI/releases/tag/2026.06.2
• https://umbraco.com/blog/security-advisory-june-4-2026-security-patch-for-umbracoai-is-now-available

Related advisories

• CVE-2026-61447 — critical · PyPI/praisonaiagents
• CVE-2026-106501 — critical · npm/@backstage/plugin-scaffolder-backend
• CVE-2026-92947 — critical · npm/vm2
• GHSA-v2f8-6655-7grj — critical · PyPI/vibe-trading-ai
• GHSA-gg6r-gp4c-89hp — critical · npm/trigger.dev
• CVE-2026-62988 — critical · Packagist/froxlor/froxlor
• GHSA-m5w8-4gq2-6f8x — critical · npm/vm2
• CVE-2026-64859 — critical · Go/github.com/QuantumNous/new-api

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity