A deficiency in Umbraco CMS caused a vertical privilege escalation where authenticated backoffice users who can manage users may assign high‑privilege roles to themselves or others. The flaw lies in missing authorization checks on user group modifications, enabling the elevation of privileges without proper enforcement. This represents missing authorization checks (CWE‑269), insufficient access control (CWE‑284), and lack of privilege verification (CWE‑862). Consequently, a malicious or inadvertently misused authenticated user could gain administrative control over the site.

The vulnerability affects Umbraco CMS versions from 15.3.1 up to, but not including, 16.5.1 and 17.2.2. Administrators should verify that their deployment runs a fixed release, namely 16.5.1 or 17.2.2, or later.

The CVSS score of 7.2 indicates moderate to high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no widespread publicly available exploits. Attackers would need authenticated backoffice access with user‑management rights to exploit the flaw, and could then promote themselves to a privileged role through the unprotected user group interface.