A vulnerability in Umbraco Engage prior to versions 16.2.1 and 17.1.1 allows attackers to hit specific API endpoints without any authentication or authorization checks. By supplying a user-controlled identifier such as "?id=", the endpoints return sensitive data tied to that identifier. Because the API performs no access control, an attacker can enumerate predictable or enumerable identifiers to harvest large volumes of analytics, tracking, customer, or other confidential Engage data, resulting in a high confidentiality impact. No integrity or availability impact has been identified.

Affected products are Umbraco Engage (Umbraco.Engage.Forms). Versions earlier than 16.2.1 on the 16.x line and earlier than 17.1.1 on the 17.x line are vulnerable.

The vulnerability carries a CVSS score of 7.5, indicating a high severity. The EPSS score is less than 1%, implying a low likelihood of immediate exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this weakness remotely by sending unauthenticated HTTP requests directly over the network to the exposed API endpoints. Since no authentication is required, exploitation is straightforward once the endpoints are discovered.