CVE-2025-27601 Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be...

CVE-2025-27601

CVE-2025-27601 concerns Umbraco in the API management package, where an improper API access control allows low-privilege authenticated users to create and update data type information restricted to settings-access users. Affected are Umbraco.Cms.Api.Management versions prior to 14.3.3 and 15.2.3....

CVE-2025-27601 Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be...

CVE-2025-27601 Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the IsAuthorized function in ContentPermissionsQueryStringHandler.cs and MediaPermissionsQueryStringHandler.cs. A user with Editor permissions can retrieve or delete content and media of other users by passing...

GHSA-WX5H-WQFQ-V698 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Impact Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. Patches Will be patched in 10.8.9 and 13.7.1 Workarounds None available...

Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Impact Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. Patches Will be patched in 10.8.9 and 13.7.1 Workarounds None available...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco version 10.8.9 and prior to version 13.7.1, which stems from manipulation of backend API URLs that could result in the retrieval or deletion of content or media t...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco version 15.2.3 and prior to version 14.3.3, which stems from improper API access control and could lead to the creation and updating of data type information by a...

The vulnerability of the Umbraco CMS system, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the Umbraco CMS content management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2024-55488

A stored cross-site scripting XSS vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed...

Cross-site Scripting (XSS)

Umbraco is vulnerable to cross-site scripting XSS. The vulnerability is due to improper sanitization in certain localized backoffice components, allowing authenticated users to inject malicious scripts when viewing these components...

Account Enumeration

umbraco.cms is vulnerable to Account Enumeration. The vulnerability is due to discrepancies in response codes and the timing of Umbraco management API responses, which allow attackers to infer the existence of specific accounts...

GHSA-572Q-86RR-5VGQ Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting

Withdrawn Advisory This advisory has been withdrawn because the issue is a documented security. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5270. Original Advisory A stored cross-site scripting XSS vulnerabili...

Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting

Withdrawn Advisory This advisory has been withdrawn because the issue is a documented security. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5270. Original Advisory A stored cross-site scripting XSS vulnerabili...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS over the /umbraco/management/api/v1/document endpoint. A user can inject scripts as rich text content which will be executed when the target page is rendered. Workaround The project maintainers note that this...

CVE-2024-55488

A stored cross-site scripting XSS vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed...

Remote Code Execution (RCE)

umbraco.headless.client.net is vulnerable to Remote Code Execution RCE. The vulnerability is due to the use of an insecure Refit package, allows an attacker to exploit the insecure Refit dependency...

CVE-2024-55488

A stored cross-site scripting XSS vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed...

CVE-2024-55488

A stored cross-site scripting XSS vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed...