CVE-2025-27602

Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

State: Published
Severity: 4.9 Medium
Published: Mar 11, 2025
Updated: Mar 11, 2025
Reserved: Mar 3, 2025

Description

Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. The issue is patched in versions 10.8.9 and 13.7.1. No known workarounds are available.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-285 Improper Authorization
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
Umbraco-CMSumbraco	< 10.8.9Affected >= 11.0.0-rc1, < 13.7.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.