---
title: Security advisory 2026-09-24
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## Account recovery flow vulnerability

**CVSS**: 8.6\
**Affected versions**: 22.0.0 - 31.8.4\
**Category**: Authentication

### Summary

A high-severity vulnerability was identified in the administration interface user account recovery flow. Under specific circumstances, the application could accept information from a less trusted source when performing security-sensitive operations, potentially resulting in unauthorized administrative access.

Xperience by Kentico [SaaS](https://docs.kentico.com/documentation/developers-and-admins/saas.md) instances are not affected.

### How to fix

Update to version **31.9.0** or newer. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.

If you cannot update immediately, configure the [service domain for system emails](https://docs.kentico.com/documentation/developers-and-admins/configuration/notifications.md#service-domain) to the domain where you host the administration interface using the `SystemEmailOptions.ServiceDomain` configuration key.

### Acknowledgments

This issue was reported by Ahmed Ibrahim.

## Insufficient workspace permission validation

**CVSS**: 7.1\
**Affected versions**: 30.0.0 - 31.8.4\
**Category**: IDOR

### Summary

An authorization issue in the Content hub application could allow an authenticated user with permissions in one workspace to view limited metadata of content items in other workspaces, and under specific circumstances move a content folder into a workspace they were not assigned to. The issue was not reproducible through conventional admin UI operations.

### How to fix

Update to version **31.9.0** or newer. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.

### Acknowledgments

This issue was reported by Ahmed Ibrahim.