Most severe vulnerabilities for "umbraco umbraco cms" 11.0.0

Where

AND

Sort:

Umbraco Umbraco CMSUmbraco allows possible Admin-level access to backoffice without Auth under rare conditions

Risk 86

Severity

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.

First published (updated )

CVE-2023-37267

nuget/Umbraco.Cms.Web.BackofficeUmbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Risk 28

Severity

6.4

EPSS

0.03%

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Impact Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to.

Patches Will be patched in 10.8.9 and 13.7.1

Workarounds None available.

1 / 2

Source: GitHub

First published (updated )

CVE-2025-27602

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Trending

Umbraco Umbraco CMSUmbraco allows possible Admin-level access to backoffice without Auth under rare conditions

nuget/Umbraco.Cms.Web.BackofficeUmbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Company

Resources

Contact