Umbraco CMS has a broken object‑level authorization flaw in a backoffice API that lets any authenticated user assign domains to content nodes without proper access checks. This failure allows a user who should not have permission to modify a node to attach arbitrary domain data, potentially enabling domain hijacking, phishing, or brand impersonation. The weakness is classified as CWE‑639 and results in unauthorized data integrity compromise, but does not provide remote code execution or service disruption.

The vulnerability affects Umbraco CMS versions from 14.0.0 up to, but not including, 16.5.1 and from older releases up to, but not including, 17.2.2. Users running these CMS releases should review their installations to determine if they are on a vulnerable version.

The CVSS base score is 5.4, indicating a moderate severity. The EPSS score is less than 1 %, showing a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and an API call to the affected endpoint; no additional privileges or network access beyond normal user credentials are needed. Given the limited exposure, the overall risk is moderate but should be addressed promptly to prevent potential domain manipulation.