medium4.9
CVE-2025-27602
Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
Impact
### Impact Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. ### Patches Will be patched in 10.8.9 and 13.7.1 ### Workarounds None available.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Umbraco.Cms.Web.Backoffice | <= 10.8.8 | 10.8.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Umbraco | Umbraco Cms | before 10.8.9 from 11.0.0 before 13.7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/umbraco/Umbraco-CMS/commit/5b54bed406682ceff57903bf7d3c57814eef31a7
- https://github.com/umbraco/Umbraco-CMS/commit/7888b9a4ce5ae7f9bda7ff3bb705b8fcd2f1675d
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wx5h-wqfq-v698
- https://github.com/advisories/GHSA-wx5h-wqfq-v698
- https://nvd.nist.gov/vuln/detail/CVE-2025-27602