Umbraco CMS 18.3.0 brings fixes for several security issues, ImageSharp dependency and licensing changes that need attention, new features such as member and group filters, breadcrumbs and server-side sorting, plus performance improvements and many bug fixes.
Umbraco 17.8.0 fixes multiple critical security issues, updates SixLabors.ImageSharp (note potential release-build license checks), adds features like hasChildren in the Management API, breadcrumbs, server-side sorting and preview reconnects, and includes many bug fixes and performance improvements.
umbraCoffee hosts Marcin and Callum discuss AI-generated intros, Umbraco events, and community energy; Martin joins ABC Fitness as Principal AI Engineer to discuss AI adoption challenges. They warn AI-enabled mass exploitation of vulnerabilities, urge better patching, observability, automation, Dependabot, and praise tooling, community efforts, events, and feedback.
2026-11-12 from 18:30 to 20:30 (Europe/London) - MSQ DX, Royal House, 28 Sovereign Street, Leeds, LS1 4BA, Leeds, GB
Anders Nis Herforth Larsen reports that ten vulnerabilities across Umbraco CMS, Umbraco Forms, and Umbraco AI (two high, seven moderate, one low) were fixed; patches released (CMS 13.16.3/17.7.2/18.2.2, Forms 13.9.12/17.6.2/18.2.2, AI components updated). Upgrade recommended; interim mitigations provided.
Mats Persson explains that recent critical PHP vulnerabilities (CVSS 9.2) do not affect Umbraco because it runs on .NET/ASP.NET Core, not PHP; organizations should still patch any PHP-based sites or tools they run alongside Umbraco, keep Umbraco/.NET updated, and embrace open disclosure and community cooperation for security.
Anders Nis Herforth Larsen reports that four vulnerabilities in Umbraco CMS have been identified and patched, with two classified as moderate and two as low severity. Users are advised to upgrade to versions 17.7.1 or 18.2.1 to mitigate risks, particularly for those using custom media path schemes.
Blocks compromised passwords and logins for Umbraco members and backoffice users by checking them against the DarkStrata breach corpus using k-anonymity.
Justin Neville discusses the challenge of implementing both a strict Content Security Policy (CSP) with nonces and output caching on the Nevitech website. He presents a solution involving middleware that replaces nonce placeholders in cached HTML and rewrites CSP headers, ensuring consistency and functionality without sacrificing either feature.
In this episode of #umbraCoffee, hosts Marcin and Callum discuss the transition back to school, productivity impacts of summer breaks, and busy work schedules. They also delve into AI integration in development, community support, and the need for secure solutions within the Umbraco community.
Anders Nis Herforth Larsen reports four vulnerabilities in Umbraco CMS, Forms, and AI, including one high-severity issue. Patches are available for affected versions, and users are urged to upgrade. Notably, Umbraco 14, 15, and 16 will not receive patches. Mitigation strategies are provided for those unable to upgrade immediately.
A high-level security vulnerability in Umbraco Forms versions 13, 17, and 18 has been identified and patched. Users are advised to upgrade to the latest versions to mitigate risks, as unsupported versions remain vulnerable. The flaw allows unauthenticated users to bypass submission safeguards. Automatic upgrades are available for Umbraco Cloud users.
A high-severity vulnerability affecting Umbraco versions 13.0.0 - 13.15.0, 17.0.0 - 17.5.2, and 18.0.0 - 18.0.1 has been identified and patched. Users are advised to upgrade to supported versions. The vulnerability allows unauthorized content retrieval via the delivery API. Thanks to Ardya Suryadinata for reporting the issue.
Matt Brailsford announces a security patch for the Umbraco.AI package, addressing a vulnerability in versions 1.0.0 through 1.13.x. Users are urged to update to version 1.14.0 or later. The patch enforces strict configuration reference resolution, enhancing security by restricting access to sensitive information. Further details are available in the GitHub Security Advisory.
The Umbraco Security Dashboard is a package that provides a dashboard within the Umbraco backoffice to help identify potential security vulnerabilities in installed packages.
An Umbraco package that restricts access to your site (or specific paths) by IP address whitelist.
At Digital Excellence 2026, Jeppe Birkebæk Truelsen demonstrated how Umbraco enables membership organizations to scale content while maintaining brand voice and data security. By implementing a governance layer for AI, organizations can define boundaries and retain control, ensuring AI acts as an assistant rather than a decision-maker, fostering accountability and trust.
WebAuthn/FIDO2 passkey add-on for Umbraco 17 passwordless member authentication.
One-time password (OTP) email add-on for Umbraco 17 passwordless member authentication.