ghsa-wx5h-wqfq-v698
Vulnerability from github
Published
2025-03-11 15:27
Modified
2025-03-12 14:40
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Summary
Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
Details

Impact

Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to.

Patches

Will be patched in 10.8.9 and 13.7.1

Workarounds

None available.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.8.8"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Cms.Web.Backoffice"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.8.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 13.7.0"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Cms.Web.Backoffice"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-rc1"
            },
            {
              "fixed": "13.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-27602"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-11T15:27:34Z",
    "nvd_published_at": "2025-03-11T16:15:18Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nVia manipulation of backoffice API URLs it\u0027s possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to.\n\n### Patches\nWill be patched in 10.8.9 and 13.7.1\n\n### Workarounds\nNone available.",
  "id": "GHSA-wx5h-wqfq-v698",
  "modified": "2025-03-12T14:40:32Z",
  "published": "2025-03-11T15:27:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wx5h-wqfq-v698"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27602"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/commit/5b54bed406682ceff57903bf7d3c57814eef31a7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/commit/7888b9a4ce5ae7f9bda7ff3bb705b8fcd2f1675d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/umbraco/Umbraco-CMS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.