June 2026: Umbraco.AI got its first advisory, and the patch breaks your config

· JD + AI · Umbraco

June 2026: Umbraco.AI got its first advisory, and the patch breaks your config

If you run Umbraco.AI, check the version before you read anything else. Versions 1.0.0 through 1.13.x of the core package carry a moderate information-disclosure flaw, and the fix, 1.14.0, is also a breaking change. Matt Brailsford published the advisory on Umbraco's own blog on 4 June.

That is the item that needs action this week. It is also the start of a pattern. June is the densest month this ecosystem has given us for news with a hard date attached, and five of the fourteen items below carry one: a patch, a keynote, a major release, a support window, and an end-of-life date. Four of the five are clocks. The fifth is the vendor mentioning the first one in a footnote.

One disclosure before the detail. Five of these fourteen sources are Umbraco's own blog, which is 36% of the post coming from the company that sells the product. That matters most in the migration section, where the technical advice and the hosting pitch arrive in the same paragraph.

4 June: the flaw is small, the patch is not

The advisory is specific, which is more than most vendors manage. The flaw affects Umbraco.AI Core 1.0.0 through 1.13.x. Provider and add-on packages (OpenAI, Anthropic, Agent, Prompt, Search, Deploy) are affected only through their dependency on Core, so updating Core resolves all of them. Brailsford describes it as an "information-disclosure issue across a trust boundary, affecting confidentiality only", requiring an authenticated user with access to the AI section. There is no unauthenticated vector. The full write-up is published as GHSA-q3v2-xj35-9grx.

The cost is in the fix. From 1.14.0 the $Key:Path configuration reference syntax resolves against a strict allow-list, defaulting to Umbraco:AI:Secrets and Umbraco:AI:Variables. If your connection or context settings reference anything outside those sections, $OpenAI:ApiKey being the example in the advisory, they stop resolving the moment you upgrade. You move the value, or you add the prefix to Umbraco:AI:AllowedConfigurationKeyPrefixes in appsettings.json. Budget a config review, not a version bump.

The design decision underneath is right. An AI section can be delegated to non-administrator user groups, and a settings field that resolves arbitrary application configuration is a privilege escalation waiting for somebody to notice. Default-deny is the correct answer.

10 June: the same advisory, filed under "In other news"

Filip Bech-Larsen's Codegarden keynote write-up on Umbraco's blog runs past five thousand words: Umbraco Automate as a new open-source automation add-on (beta for Umbraco 17 from that day, final release 9 July), Remote MCP on Cloud, load balancing and scheduled upgrades on Cloud, Elements in the CMS, and updates across Commerce, Engage, Deploy and Compose. It is a vendor product post and it reads like one.

The Umbraco.AI advisory is in there, one sentence under "In other news", after the section explaining when the conference talks reach YouTube. Six days earlier the same company published a careful, precise security advisory. Here the same vulnerability sits between conference logistics and a roadmap link. If the product update is your only channel into Umbraco news, you would skim straight past it, and that is a choice somebody made.

Automate is the part to actually watch. It runs inside your own infrastructure rather than as a hosted third party, it has human-in-the-loop approval steps, and it calls Umbraco.AI agents as workflow steps. Which is to say: an automation engine that invokes AI steps is one more place for a configuration-resolution bug to become interesting. This is the vendor describing its own product on launch day, so read the capability list as a roadmap and confirm against the docs before you scope anything on it.

30 June: Umbraco 13 dies on 14 December 2026

Arnold Visser's post, also on Umbraco's blog, names the date. He lays out two paths to 17 LTS: upgrade the existing solution and run the migrations, or build fresh on 17 and move content and schema with Umbraco Deploy import/export. He recommends the second for anything carrying legacy, on the reasonable grounds that Umbraco 14's new backoffice architecture and extension model make this a natural rebuild point.

It is also a Cloud sales post. Deploy is included with every Cloud plan, the support team appears in three separate sections, and XLTS is offered as the 6, 12 or 24-month bridge if you cannot make December. The technical reasoning holds. The commercial framing is unmistakable. Take the date as fact and the hosting recommendation as a pitch.

The counterweight arrived two weeks earlier in a Codegarden write-up on jeroenbreuer.nl. Our harvest recorded no byline for that page; the post is signed by Jeroen Breuer, so the record was wrong and the credit is his. Reporting from the migration workshop run by Callum Whyte and Jason Elkin, his summary is that "you don't upgrade from v13 to v17, you migrate to it". The section he found most eye-opening was Hybrid Cache, because the shape of your content tree now matters far more than it did in 13: deep traversals through the cache are no longer something you get for free. That is the sentence that changes a migration estimate, and it is not in the vendor's post.

For the extreme version, Pasang Tamang documented an Umbraco 8 to 17 jump in one leap in Skrift, treating the v8 uSync export as an immutable specification, using Cursor to build a dependency graph of the schema, and driving the Umbraco MCP to materialise document types, data types and Block List configuration against a live v17 instance. It is one team's account of one migration rather than a supported path. The transferable idea is the method, making the uSync snapshot the contract, more than the AI tooling wrapped around it.

25 June: Umbraco 18 shipped, and the package author explained the support window better

Bolette Kern announced Umbraco 18 and called it, accurately, "a short and sweet release". One headline feature: a Library section in the backoffice, whose first inhabitant is Elements. These are reusable, non-routable content items created from Element Types via a new "allow in Library" toggle and selected with an Element Picker. Every agency has built this by hand as a hidden "global" node stuffed with template-less doc types. Now it is a feature rather than a pattern you reinvent per project.

The scoping is honest, which is worth saying when it happens. Elements do not integrate with Block Editors until Umbraco 19 in Q4 2026, and that is where edit-once-update-everywhere actually lands. Umbraco 17 stays the LTS and the recommended home. 18 is Standard-Term Support.

Kevin Jump shipped uSync v18 the same day with import and export for Library elements, and his release note says the thing the vendor post does not: you "shouldn't go to a STS release unless you are prepared and can upgrade your site every six months". He also flags that Umbraco's move from Swashbuckle to Microsoft's OpenAPI libraries breaks anyone consuming uSync's management API, with no backwards-compatible layer offered. Package authors absorb the cost of a platform's API churn, and they are usually the first to say so out loud.

The rest of the month was AI, and one of the AI posts was a security fix in disguise

Paul Seal shipped PasswordGenerator v3 on 1 June and files it as a features post, but the fixes are the story. The old version had modulo bias in character selection and used a GUID-based shuffle, both now replaced. On a library Seal reports at over 13 million downloads, that is a real correction. v3 raises the floor to .NET 8 and drops .NET Standard 2.0, and invalid settings now throw rather than returning the string "Try again" as a password. The 2.x line still works if you are stuck on an older runtime. These are the maintainer's own figures, from his blog and his package.

Aaron Sawyer's Skrift piece walks through running the Umbraco MCP against a local LLM in LM Studio with no AI subscription. The detail worth keeping: raise the model's context length well past the 4,096 default before it can do anything useful over MCP. For clients who will not send content to a hosted model, this is the cheapest way to evaluate the tooling.

Mark Downie's Visual Studio June update is ecosystem news that lands on Umbraco desks: MCP servers now get a trust check before they run anything new, and Copilot usage is metered and displayed by token consumption rather than by request. Both changes affect anyone running the Umbraco MCP inside Visual Studio.

Diagram, an Umbraco Platinum Contributing Partner who build on the platform commercially, account for three of the fourteen items here. Chris Osterhout argues across two of them, Fast Content, Slow Launches and Enterprise AI Has a Context Problem, that enterprise AI fails on incomplete context rather than weak models, and that the delay in launching a page was never the copywriting: it is confirming pricing, locating approved assets and finding out whether legal already reviewed the language. That is a fair description of the problem and also a description of what a content-orchestration consultancy sells. In the third, Bill Casey announces Diagram and NATP winning Best Enterprise Solution at the 2026 Umbraco Awards; read it as a case study of Umbraco as an orchestration layer over membership, learning and commerce systems, because that is what it is.

Mats Persson's post on Umbraco's blog is the vendor arguing against its DXP competitors, asking whether buyers are "paying for actual business value, or... paying a massive premium to fund a legacy vendor's restructuring". The argument against tying a data strategy to one vendor's proprietary AI framework is reasonable and applies to Umbraco too. The 400% premium figure in it is unsourced, and it is a positioning piece from the company selling the alternative.

The AI surface is now part of your patch inventory

Umbraco has shipped AI into the platform fast, and June is the month that started charging interest. The Umbraco.AI flaw is not severe by itself. Authenticated, confidentiality only, no unauthenticated vector. The shape of it is what should hold your attention: it existed because an AI settings field could resolve application configuration, which is precisely the sort of convenience that gets built when a product surface is moving quickly. There will be more of these.

So the practical consequence is inventory, not panic. Umbraco.AI, the Umbraco MCP, Automate and Remote MCP on Cloud belong on the patch list as first-class components, not as optional extras somebody installed to try during a sprint. If nobody on your team can answer "which Umbraco.AI version is in production" inside a minute, that is the real finding from this month, and it is worth more than the upgrade planning.

On the upgrade planning: if you are still on 13 and have not started, buy the XLTS. Six to twenty-four months of paid support to do the migration properly is cheaper than doing it in November, and Breuer's Hybrid Cache point is a good indication of how much design work the honest version of this migration actually contains.

Sources

umbraco · umbraco-backoffice · deployment · ai · product · community · release · commerce

2026 © Umbracolombia - All rights reserved.