The vulnerability exists in Surface Controllers that support member operations within Umbraco CMS. These controllers fail to validate user‑controlled redirect URLs; a malicious actor can supply a crafted query parameter to redirect a legitimate user to an arbitrary site, potentially facilitating phishing or malware distribution. The flaw is a classic open‑redirect weakness (CWE‑601) and represents a moderate attack surface as it requires direct interaction with the application over the web.

Any Umbraco CMS installation using the 13.x series prior to version 13.14.0 or the 17.x series before version 17.4.0 is impacted. The segmentation is limited to Surface Controllers handling member‑related requests; other parts of the CMS are not affected.

The CVSS score of 5.4 classifies the issue as moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a user supplying a crafted URL parameter that is not properly sanitized, allowing a redirection to an external site. No advanced prerequisites or privileged conditions are required beyond standard web access.