PT-2025-10787 · Umbraco · Umbraco

Hazemeldoc · Published 2025-03-11 · Updated 2025-03-11 · CVE-2025-27602

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Umbraco versions prior to 10.8.9 Umbraco versions prior to 13.7.1

Description: The issue allows authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to, via manipulation of backoffice API URLs.

Recommendations: For versions prior to 10.8.9, update to version 10.8.9 or later. For versions prior to 13.7.1, update to version 13.7.1 or later.

Exploit

Fix

LPE

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2025-27602

GHSA-WX5H-WQFQ-V698

Affected Products

Umbraco

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27602.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/commit/7888b9a4ce5ae7f9bda7ff3bb705b8fcd2f1675d · Patch
• https://github.com/umbraco/Umbraco-CMS/commit/5b54bed406682ceff57903bf7d3c57814eef31a7 · Patch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wx5h-wqfq-v698 · Patch
• https://osv.dev/vulnerability/GHSA-wx5h-wqfq-v698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27602 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27602 · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://t.me/cvetracker/18960 · Telegram Post
• https://twitter.com/CVEnew/status/1899488078361677933 · Twitter Post