What is GHSA-h66j-xm43-47pp?

GHSA-h66j-xm43-47pp is a security advisory published by GitHub Security Advisories with Medium severity. Umbraco CMS contains a server-side request forgery vulnerability

Which CVE IDs does GHSA-h66j-xm43-47pp cover?

GHSA-h66j-xm43-47pp covers the following CVE IDs: CVE-2021-47776. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h66j-xm43-47pp?

GHSA-h66j-xm43-47pp has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-h66j-xm43-47pp?

GHSA-h66j-xm43-47pp affects 1 product, including: nuget/UmbracoCms:= 8.14.1.

GHSA-h66j-xm43-47ppMediumCVSS 5.3

Umbraco CMS contains a server-side request forgery vulnerability

Vendor

GitHub Security Advisories

Published

January 15, 2026

Last Modified

January 15, 2026

🔗 CVE IDs covered (1)

CVE-2021-47776 →

📋 Description

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHelpForPage, GetRemoteDashboardContent, and GetRemoteDashboardCss endpoints to trigger unauthorized server-side requests to external hosts.

🎯 Affected products1

nuget/UmbracoCms:= 8.14.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-47776
https://our.umbraco.com
https://releases.umbraco.com/all-releases
https://www.exploit-db.com/exploits/50462
https://github.com/advisories/GHSA-h66j-xm43-47pp