Umbraco

📰 Security Advisory, Oct 27, 2026: Security Patches for Umbraco CMS, Umbraco Forms, and Umbraco AI now available

Anders Nis Herforth Larsen reports that ten vulnerabilities across Umbraco CMS, Umbraco Forms, and Umbraco AI (two high, seven moderate, one low) were fixed; patches released (CMS 13.16.3/17.7.2/18.2.2, Forms 13.9.12/17.6.2/18.2.2, AI components updated). Upgrade recommended; interim mitigations provided.

🚨 [Breaking change]: Forms Security will be replaced by CMS user group permissions in Umbraco Forms 20

Rick Butterfield explains that Umbraco Forms 20 replaces its separate "Forms Security" with standard CMS user-group permissions. Permissions move to the CMS user group Permissions tab, become additive (no deny/fallback), remove per-user and start-folder settings, and migrate existing setups to group grants. Several APIs, storage tables, and config settings are removed or reshaped.

📰 Security Advisory: Security Patches for Umbraco CMS, Umbraco Forms, and Umbraco AI now available

Anders Nis Herforth Larsen reports four vulnerabilities in Umbraco CMS, Forms, and AI, including one high-severity issue. Patches are available for affected versions, and users are urged to upgrade. Notably, Umbraco 14, 15, and 16 will not receive patches. Mitigation strategies are provided for those unable to upgrade immediately.

📰 Security Patches for Umbraco Forms are now available

A high-level security vulnerability in Umbraco Forms versions 13, 17, and 18 has been identified and patched. Users are advised to upgrade to the latest versions to mitigate risks, as unsupported versions remain vulnerable. The flaw allows unauthenticated users to bypass submission safeguards. Automatic upgrades are available for Umbraco Cloud users.

🚨 [Breaking change]: Remove the built-in Bootstrap 3 horizontal forms theme from Umbraco Forms

Umbraco Forms 19 removes the bootstrap3-horizontal theme, which was incompatible with Bootstrap 4 and 5, as Bootstrap 3 reached end-of-life in July 2019. Developers are advised to create custom themes for their Bootstrap versions. The change reduces maintenance and avoids misleading developers regarding theme compatibility.

🚨 [Breaking change]: Replace Pikaday with native HTML date input in the Umbraco Forms default theme

In Umbraco Forms 19, the Date field type transitions from using Pikaday and Moment.js to a native <input type="date">, enhancing performance and simplifying model binding. This change eliminates hidden shadow fields and third-party dependencies, ensuring consistent ISO date formatting across browsers. Custom themes must be updated accordingly.

🚨 [Breaking change]: Remove jQuery Validation support from Umbraco Forms client-side scripts

Umbraco Forms 19 removes the jQuery Validation alternative, making aspnet-client-validation the sole supported client-side validation framework. The legacy umbracoforms-conditions.js is also deleted, simplifying maintenance and eliminating jQuery dependencies. Users must update their sites to restore @Html.RenderUmbracoFormDependencies(Url) and remove jQuery validation scripts.

📰 Automate Your Lead Flow in Umbraco with Webhooks and Zapier

Niels Christian Laursen's article introduces a no-code approach to automating lead flow in Umbraco using webhooks and Zapier. It outlines a step-by-step process for validating, enriching, and routing leads from Umbraco Forms to Zoho CRM, emphasizing the ease of creating powerful automations without coding experience.

👀 Umbraco Forms Subscription Licensing Details Released

💬 Umbraco Forms 13.4 and 15.1 release candidates are out

💬 Umbraco Forms V13.3 and V14.2 are out!