{"data":{"id":"3ad32281-e450-4b5f-893e-b2edc3ded28f","title":"GHSA-q3v2-xj35-9grx: Umbraco.AI discloses sensitive application configuration values","summary":"Umbraco.AI discloses sensitive application configuration values to a user with elevated privileges under certain configurations. Exploitation requires access to the AI section of the backoffice and a specific custom AI provider, and disclosure could expose secret material such as credentials, potentially enabling further compromise.","solution":"Patched in 1.14.0. The source states that the patch is a breaking change requiring a version jump, and that a workaround is not recommended.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-q3v2-xj35-9grx","publishedAt":"2026-07-14T19:59:45.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["Umbraco.AI@<= 1.13.0 (fixed: 1.14.0)"],"affectedPackageNames":["umbraco-ai"],"affectedPackageRefs":["nuget:umbraco-ai"],"affectedVendors":[],"affectedVendorsRaw":["Umbraco.AI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-q3v2-xj35-9grx"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-14T19:59:45.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}