Vulnerability Description
Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. The issue is patched in versions 10.8.9 and 13.7.1. No known workarounds are available.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Umbraco | Umbraco Cms | < 10.8.9 |
Related Weaknesses (CWE)
References
- https://github.com/umbraco/Umbraco-CMS/commit/5b54bed406682ceff57903bf7d3c57814ePatch
- https://github.com/umbraco/Umbraco-CMS/commit/7888b9a4ce5ae7f9bda7ff3bb705b8fcd2Patch
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wx5h-wqfq-v698PatchThird Party Advisory
FAQ
What is CVE-2025-27602?
CVE-2025-27602 is a vulnerability with a CVSS score of 4.9 (MEDIUM). Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via manipulation of backoffice API URLs, it's pos...
How severe is CVE-2025-27602?
CVE-2025-27602 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-27602?
Check the references section above for vendor advisories and patch information. Affected products include: Umbraco Umbraco Cms.