CVE-2021-47776

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.

Published Jan 16, 2026

https://github.com/advisories/GHSA-h66j-xm43-47pp

CVSS ScoreMedium

5.3

Ecosystem	Package	Version

Ecosystem	Package	Version

Vulnerabilities

CVE-2021-47776

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.

Published Jan 16, 2026

https://github.com/advisories/GHSA-h66j-xm43-47pp

CVSS ScoreMedium

5.3


nuget	UmbracoCms	8.14.1

Ecosystem	Package	Version


nuget	UmbracoCms	8.14.1

Find vulnerabilities. Fix fast with AI.

CVE-2021-47776

CVE-2021-47776