CVE-2025-27602
1 advisory.
NuGet/Umbraco.Cms.Web.Backoffice CVE-2025-27602: medium 4.9
Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
Action: Upgrade Umbraco.Cms.Web.Backoffice to 10.8.9 (10.x) or 13.7.1 (13.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.8.9 | - |
| 11.0.0-rc1 | 13.7.1 | - |
Fixed versions
| 10.8.9 | 13.7.1 |
Sources
- osv: GHSA-wx5h-wqfq-v698
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wx5h-wqfq-v698
- https://nvd.nist.gov/vuln/detail/CVE-2025-27602
- https://github.com/umbraco/Umbraco-CMS/commit/5b54bed406682ceff57903bf7d3c57814eef31a7
- https://github.com/umbraco/Umbraco-CMS/commit/7888b9a4ce5ae7f9bda7ff3bb705b8fcd2f1675d
- https://github.com/umbraco/Umbraco-CMS
CVE-2025-27602 · published · modified · JSON