CVE-2025-27601: Umbraco.Cms.Api.Management Allows Improper API Access Control to Low-Privilege Users
Summary
CVE-2025-27601: Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality. Affects Umbraco.Cms.Api.Management across 2 version ranges.
< 14.3.3
>= 15.0.0-rc1, < 15.2.3
Fixed in 14.3.3 or 15.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Umbraco.Cms.Api.Management is a package within the Umbraco CMS ecosystem, designed to facilitate management operations through its API. This package enables developers to create and manage content types, data types, and other settings essential for the functioning of Umbraco websites. However, it has been identified that certain API endpoints do not enforce proper access controls, allowing low-privilege users to perform actions that should be restricted to higher-privilege users.
Vulnerability Detail
The vulnerability arises from improper API access control mechanisms within the Umbraco.Cms.Api.Management package. This flaw allows authenticated users with low privileges to create and update data type information, which should only be accessible to users with administrative rights. The implications of this vulnerability include unauthorized modifications to critical data structures, potentially leading to data integrity issues and unauthorized access to sensitive configurations.
How To Fix
Latest published version: 18.2.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 14.3.314.3.3 -
>= 15.0.0-rc1, < 15.2.315.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no available workarounds for this vulnerability. It is recommended to apply the patch as soon as it is feasible.
Conclusion
The identified vulnerability in the Umbraco.Cms.Api.Management package poses a significant risk by allowing low-privilege users to access and modify sensitive data type information. Immediate action is required to update to the patched versions to mitigate this risk.
See every vulnerability recorded for Umbraco.Cms.Api.Management →
FAQ
CVE-2025-27601 is a vulnerability in the Umbraco.Cms.Api.Management package that allows low-privilege users to improperly access and modify data type information.
The risks include unauthorized changes to data types, which can lead to data integrity issues and potential exposure of sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
The patches for this vulnerability will be available in versions 14.3.3 and 15.2.3 of the Umbraco.Cms.Api.Management package.
References
Related vulnerabilities
Recent vulnerabilities recorded for Umbraco.Cms.Api.Management.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
