CVE-2024-43376: Umbraco.Cms.Api.Management - Generation of Error Message Containing Sensitive Information
Summary
CVE-2024-43376: Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information. Affects Umbraco.Cms.Api.Management versions >= 14.0.0, < 14.1.2. Fixed in 14.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Umbraco CMS is an open-source content management system that allows users to create and manage websites. The Umbraco.Cms.Api.Management package is a component of Umbraco CMS that provides an API for managing various aspects of the CMS. This package is vulnerable to a security issue that allows the generation of error messages containing sensitive information.
Vulnerability Detail
The vulnerability in Umbraco.Cms.Api.Management allows certain endpoints in the Management API to return stack trace information, even when Umbraco is not in debug mode. This can potentially expose sensitive information about the system and its configuration. An attacker could exploit this vulnerability to gain insights into the application's internal workings and potentially discover additional vulnerabilities or exploit existing ones.
How To Fix
Latest published version: 18.2.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
14.1.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually disable the Management API endpoints that are affected by this vulnerability. By modifying the application's code or configuration, the endpoints can be disabled or restricted to prevent the exposure of sensitive information. However, this workaround may impact the functionality or usability of the Umbraco CMS, and it is recommended to apply the official fix as soon as possible.
Conclusion
Umbraco.Cms.Api.Management is vulnerable to the generation of error messages containing sensitive information. This can potentially expose details about the system's configuration and internal workings. To mitigate this vulnerability, it is advised to update the package to version 14.1.2 or later. Alternatively, developers can apply a temporary workaround by disabling or restricting the affected Management API endpoints. It is important to prioritize the security of the application and promptly address this vulnerability.
See every vulnerability recorded for Umbraco.Cms.Api.Management →
FAQ
Umbraco CMS is an open-source content management system that allows users to create and manage websites. It provides a flexible and customizable platform for building web applications.
Umbraco.Cms.Api.Management is a package that provides an API for managing various aspects of Umbraco CMS. It allows developers to programmatically interact with the CMS and perform tasks such as content creation, user management, and configuration.
This vulnerability allows the generation of error messages containing sensitive information, even when Umbraco is not in debug mode. This can potentially expose details about the system's configuration and internal workings, which could aid attackers in identifying vulnerabilities or exploiting existing ones.
To fix this vulnerability, update the Umbraco.Cms.Api.Management package to version 14.1.2 or later. This version includes a fix that prevents the generation of error messages containing sensitive information. After updating the package, thoroughly test the application to ensure the vulnerability has been mitigated.
As a temporary workaround, you can manually disable or restrict the affected Management API endpoints. However, this may impact the functionality or usability of Umbraco CMS. It is recommended to apply the official fix as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for Umbraco.Cms.Api.Management.
