Improper Authorization in Umbraco CMS

1) Improper Authorization

EUVDB-ID: #VU105961

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-27601

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to improper API access control. A remote user can create and update data type information that should be restricted to users with access to the settings section.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Umbraco CMS: 14.3.0 - 15.2.2

CPE2.3

• cpe:2.3:a:umbraco:umbraco:14.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:umbraco:umbraco:15.2.2:*:*:*:*:*:*:*

External links

https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd
https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c
https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.