CVE-2025-27601: Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

Published Mar 11, 2025
·
Updated

Impact An improper API access control issue has been identified, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section.

Patches Will be patched in 14.3.3 and 15.2.3.

Workarounds None available.

Other sources

Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are available.

— MITRE

Affected Software

5 affected componentsFixes available
Umbraco Umbraco API Management Package<15.2.3, <14.3.3
nuget/Umbraco.Cms.Api.Management<=14.3.2
14.3.3
nuget/Umbraco.Cms.Api.Management>=15.0.0-rc1<=15.2.2
15.2.3
Umbraco Umbraco CMS<14.3.3
Umbraco Umbraco CMS>=15.0.0<15.2.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade nuget/Umbraco.Cms.Api.Management to a version that resolves this vulnerability.

    Fixed in 14.3.3
  2. Upgrade

    Upgrade nuget/Umbraco.Cms.Api.Management to a version that resolves this vulnerability.

    Fixed in 15.2.3
  3. Upgrade

    Upgrade Umbraco API management package to a version that resolves this vulnerability.

    Fixed in 15.2.3
  4. Upgrade

    Upgrade Umbraco API management package to a version that resolves this vulnerability.

    Fixed in 14.3.3

Event History

Mar 11, 2025
Advisory Published
via GitHub·03:27 PM
CVE Published
via MITRE·03:30 PM
Data Sourced
via MITRE·03:30 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
RemedyAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-27601?

CVE-2025-27601 is classified as a medium severity vulnerability due to improper API access control.

2

How do I fix CVE-2025-27601?

To fix CVE-2025-27601, upgrade to Umbraco version 14.3.3 or 15.2.3 or later.

3

What is the impact of CVE-2025-27601?

CVE-2025-27601 allows low-privilege authenticated users to create and update restricted data type information.

4

Which versions of Umbraco are affected by CVE-2025-27601?

CVE-2025-27601 affects Umbraco versions prior to 14.3.3 and 15.2.3.

5

Is there a patch available for CVE-2025-27601?

Yes, a patch for CVE-2025-27601 is included in versions 14.3.3 and 15.2.3 of Umbraco.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203