Vulnerability Description
Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section. The issue is patched in versions 15.2.3 and 14.3.3. No known workarounds are available.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Umbraco | Umbraco Cms | < 14.3.3 |
Related Weaknesses (CWE)
References
- https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba2Patch
- https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bfPatch
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585xThird Party Advisory
FAQ
What is CVE-2025-27601?
CVE-2025-27601 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package prior to versions 15.2.3 and 14.3.3, allowin...
How severe is CVE-2025-27601?
CVE-2025-27601 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-27601?
Check the references section above for vendor advisories and patch information. Affected products include: Umbraco Umbraco Cms.