PT-2025-31370 · Umbraco · Umbraco

Andy Butland · Published 2025-07-29 · Updated 2025-07-30 · CVE-2025-54425

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Umbraco versions 13.0.0 through 13.9.2 Umbraco versions 15.0.0 through 15.4.1 Umbraco versions 16.0.0 through 16.1.0

Description Umbraco’s content delivery API can be restricted to require an API key in a header for authorization. Output caching can also be configured to improve performance. A flaw exists when both features are enabled concurrently, as caching does not differentiate requests based on the API key header. This allows an unauthorized user to retrieve cached responses for a specific path and query if a request with a valid key was recently made.

Recommendations Umbraco versions 13.0.0 through 13.9.2: Upgrade to version 13.9.3 or later. Umbraco versions 15.0.0 through 15.4.1: Upgrade to version 15.4.4 or later. Umbraco versions 16.0.0 through 16.1.0: Upgrade to version 16.1.1 or later. As a workaround, remove or reduce the output caching time period. As a workaround, implement additional restrictions to access the delivery API, such as by IP address.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-54425

GHSA-75VQ-QVHR-7FFR

Affected Products

Umbraco

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54425.json · Exploit
• https://github.com/umbraco/Umbraco-CMS/commit/9f37db18d11c8ba4e3ecdeb35291af30ebee7cd0 · Patch
• https://github.com/umbraco/Umbraco-CMS/commit/da43086017e1e318f6b5373391d78421efebce3a · Patch
• https://github.com/umbraco/Umbraco-CMS/commit/7e82c258eebaa595eadc9b000461e27d02bc030e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-54425 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54425 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75vq-qvhr-7ffr · Vendor Advisory
• https://github.com/umbraco/Umbraco-CMS · Note
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-75vq-qvhr-7ffr · Note
• https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api · Note
• https://twitter.com/VolerionSec/status/1950562753246101959 · Twitter Post
• https://twitter.com/CVEnew/status/1950562086628823066 · Twitter Post
• https://t.me/CVEtracker/28742 · Telegram Post