Umbraco released a security patch today, 28 July 2026, for a high-severity flaw in Umbraco Forms. It affects Forms 13, 17 and 18. If a site you run collects data through Umbraco Forms, this one is worth two minutes of your attention. If we manage your site on Umbraco Cloud, the short version is that you do not need to do anything.
Who is actually affected
This is a flaw in Umbraco Forms, the add-on package, not in Umbraco itself. If your site does not use Umbraco Forms, it is not affected by this advisory.
If it does, the affected versions are Forms 13.0.0 to 13.9.7, 17.0.0 to 17.4.6, and 18.0.0 to 18.0.4. The fixes ship in 13.9.8, 17.4.7 and 18.0.5. Older, unsupported major versions can carry the same vulnerability but will not get a patch, so a site on one of those needs upgrading to a supported line rather than patching in place.
What the flaw actually does
In plain terms, the way Forms tracked progress through a submission could be manipulated so the server treated a form as finished before it actually was. An unauthenticated visitor, with no login and no special access, could finalise a submission without going through the intended flow.
The practical consequence is that the server-side validation that normally runs before a submission is accepted could be bypassed, so a form could be stored in an incomplete or unverified state. Worse, any actions wired to run after submission, such as configured workflows, could still fire off the back of it. It applies to both single-page and multi-page forms. Umbraco rates it high because it is remotely exploitable, reliably reproducible, and it slips past the safeguards while still producing a stored submission and triggering downstream actions.
What to do
If your site is on Umbraco Cloud, the upgrade is being rolled out automatically today. No action needed. That covers every Cloud site we manage.
If your site is self-hosted, someone needs to apply the patch, upgrading Forms to 13.9.8, 17.4.7 or 18.0.5 as appropriate for your line. It is a standard package upgrade, not a major version jump, so on a well-kept site it is a quick, low-risk update. If you are not sure which Forms version you are on, or whether you are on Cloud at all, that is exactly the kind of thing your technical contact should be able to answer quickly.
If we look after your site
We have already checked. Every site we manage on Umbraco Cloud is covered by today's automatic rollout, and we are applying the patch to the self-hosted sites in our care rather than waiting to be asked. If yours is one of them and you want confirmation in writing, just reply and we will tell you the exact version you are running and when it was patched.
If you run Umbraco Forms somewhere we do not manage and want a hand getting it patched, get in touch.
