Authenticated users in Umbraco 14.0.0 up to just before 17.4.0 can inject arbitrary HTML into an input field that is subsequently rendered in the backoffice confirmation dialog without proper output encoding. This flaw allows an attacker to execute malicious scripts in the context of any user who views the dialog, potentially leading to session hijacking, data theft, or defacement. The security impact is limited to the browser session of the abused user but can affect all users who trigger the dialog.

The vulnerable component is the Umbraco CMS backoffice, affecting all releases from version 14.0.0 through the last minor release before 17.4.0. The fix was incorporated in version 17.4.0 and later.

The CVSS score of 4.6 indicates a medium impact, and the exploit requires the attacker to be an authenticated backoffice user, which reduces its likelihood to insider or credential‑compromise scenarios. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no large‑scale exploitation campaigns have been observed. Still, the potential for user‑browsing attacks warrants prompt mitigation wherever feasible.