What is CVE-2025-27601?

CVE-2025-27601 is a medium-severity vulnerability in Umbraco Umbraco-Cms, classified under Improper Authorization. CVSS score: 4.3/10. Published 2025-03-11.

How severe is CVE-2025-27601?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Umbraco Umbraco-Cms

CVE-2025-27601

Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are available.

Published 2025-03-11 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.003 (22.2th percentile), scored 2026-10-01.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000

Affected products

Umbraco Umbraco-Cms — versions >= 15.0.0-rc1, < 15.2.3, < 14.3.3
Umbraco Cms

Weakness classification (CWE)

References

github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x (Third Party Advisory)
github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd (Patch)
github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c (Patch)

Frequently asked questions

What is CVE-2025-27601?: CVE-2025-27601 is a medium-severity vulnerability in Umbraco Umbraco-Cms, classified under Improper Authorization. CVSS score: 4.3/10. Published 2025-03-11.
How severe is CVE-2025-27601?: Medium severity. CVSS v3 base score is 4.3 out of 10.