GitHub Advisoryadvisory · NuGet

GHSA-wx5h-wqfq-v698 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

MEDIUM Published 2025-03-11 Modified 2025-03-12 Official page ↗
Aliases
CVE-2025-27602
Ecosystem
NuGet
Packages
Umbraco.Cms.Web.Backoffice
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-285, CWE-863
Reviewed
2025-03-11

Affected packages

• NuGet Umbraco.Cms.Web.Backoffice: < 10.8.9 → fixed in 10.8.9 • NuGet Umbraco.Cms.Web.Backoffice: >= 11.0.0-rc1, < 13.7.1 → fixed in 13.7.1

Description

Impact Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. Patches Will be patched in 10.8.9 and 13.7.1 Workarounds None available.

Related

Alias · CVE (1)

  • CVE-2025-27602 Umbraco is a free and open source .NET content management system. vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References