medium4.3
CVE-2025-27601
Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
Impact
### Impact An improper API access control issue has been identified, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. ### Patches Will be patched in 14.3.3 and 15.2.3. ### Workarounds None available.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Cms.Api.Management | >= 15.0.0-rc1, <= 15.2.2 | 15.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Cms | before 14.3.3 from 15.0.0 before 15.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd
- https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x
- https://github.com/advisories/GHSA-6ffg-mjg7-585x
- https://nvd.nist.gov/vuln/detail/CVE-2025-27601