GHSA-h8wc-r4jh-mg7m Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

• NuGet Umbraco.Cms.Infrastructure: >= 9.0.0, < 10.6.1 → fixed in 10.6.1 • NuGet Umbraco.Cms.Infrastructure: >= 11.0.0, < 11.4.2 → fixed in 11.4.2 • NuGet Umbraco.Cms.Infrastructure: >= 12.0.0, < 12.0.1 → fixed in 12.0.1 • NuGet Umbraco.Cms.Web.BackOffice: >= 9.0.0, < 10.6.1 → fixed in 10.6.1 • NuGet Umbraco.Cms.Web.BackOffice: >= 11.0.0, < 11.4.2 → fixed in 11.4.2 • NuGet Umbraco.Cms.Web.BackOffice: >= 12.0.0, < 12.0.1 → fixed in 12.0.1

Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions. Impact An unauthorized user gaining admin-level access and permissions to the backoffice. Patches 10.6.1, 11.4.2, 12.0.1 Workarounds • Enabling the Unattended Install feature will mean the vulnerability is not exploitable. • Enabling IP restrictions to `*/install/*` and `*/umbraco/*` will limit the exposure to allowed IP addresses.