GitHub Advisoryadvisory · NuGet
GHSA-6ffg-mjg7-585x Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
MEDIUM
Official page ↗
- Aliases
- CVE-2025-27601
- Ecosystem
- NuGet
- Packages
- Umbraco.Cms.Api.Management
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-285, CWE-863
- Reviewed
- 2025-03-11
Affected packages
• NuGet Umbraco.Cms.Api.Management: >= 15.0.0-rc1, < 15.2.3 → fixed in 15.2.3
• NuGet Umbraco.Cms.Api.Management: < 14.3.3 → fixed in 14.3.3
Description
Impact
An improper API access control issue has been identified, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section.
Patches
Will be patched in 14.3.3 and 15.2.3.
Workarounds
None available.
Related
Alias · CVE (1)
- CVE-2025-27601 Umbraco is a free and open source .NET content management system. vulnerability
References
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x web
- https://nvd.nist.gov/vuln/detail/CVE-2025-27601 advisory
- https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd web
- https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c web
- https://github.com/umbraco/Umbraco-CMS package