Disclosed weakness · no CVE recorded

Umbraco AI tools bypass content permissions and expose deployment credentials

Umbraco · Umbraco.AI.Core, Agent, Agent.Deploy, Deploy and Search

First documented disclosure · Review checkpoint

Summary

AI tools could exceed editor permissions, while Deploy wrote provider credentials unencrypted to deployment files.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Reviewed advisories do not establish malicious exploitation or affected customer counts.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Missing or lost authorization checks in tools and deployed restrictions; cleartext credential serialization.

Conditions required

An authenticated back-office user with the affected agent tools enabled, or access to deployment files/source control. Content/media tools are not enabled by default.

Potential impact

Unauthorized reading or modification of content and exposure of AI provider keys.

Affected versions and configurations

Core 1.0.0–17.6.0 and 18.0.0–18.6.0; Agent 1.1.0–17.4.0 and 18.0.0–18.4.0; Agent.Deploy 1.0.0-beta2–17.1.0 and 18.0.0–18.1.0; Deploy 1.0.0-beta1–17.3.0 and 18.0.0–18.3.0; Search 1.0.0-beta1–17.0.4 and 18.0.0–18.0.4.

Fix and mitigation status

Core 17.6.1/18.6.1; Agent 17.4.1/18.4.1; Agent.Deploy 17.1.1/18.1.1; Deploy 17.3.1/18.3.1; Search 17.0.5/18.0.5.

Practical next steps

Manually upgrade AI add-ons, including on Umbraco Cloud. Rotate provider keys if deployment files containing them entered source control.

Operating lesson

Agent tools must enforce the caller’s permissions, and deployment artifacts must not carry plaintext secrets.

Evidence and limits

October 22 heads-up disclosed affected AI packages; October 27 published GHSA-xc89-5cg7-36xf and fixes. The advisory has no known CVE. Provider rating is Moderate (CVSS 3.1 6.5); this inventory uses Medium for the same band. Generic CMS/Forms vulnerabilities are excluded.

Sources