Auth bypass in Umbraco Umbraco-Cms
CVE-2025-27601
Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are available.
EPSS: 0.003 (22.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Umbraco Umbraco-cms — versions >= 15.0.0-rc1, < 15.2.3, < 14.3.3
- Umbraco Umbraco_cms
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-27601?
- CVE-2025-27601 is a medium-severity vulnerability in Umbraco Umbraco-Cms, classified under Improper Authorization. CVSS score: 4.3/10. Published 2025-03-11.
- How severe is CVE-2025-27601?
- Medium severity. CVSS v3 base score is 4.3 out of 10.