CVE-2025-27602: Umbraco CMS Privilege Escalation Flaw

CVE-2025-27602 Overview

CVE-2025-27602 is a broken access control vulnerability in Umbraco CMS, an open source .NET content management system. Authenticated backoffice users can manipulate backoffice API URLs to retrieve or delete content and media stored in folders they do not have permission to access. The flaw affects Umbraco versions prior to 10.8.9 and 13.7.1, and is classified under [CWE-285: Improper Authorization]. The issue is patched in versions 10.8.9 and 13.7.1, and no workarounds are available.

Critical Impact
Authenticated low-privilege backoffice editors can read or delete content and media in folders outside their assigned permission scope by tampering with API request parameters.

Affected Products

Umbraco CMS versions prior to 10.8.9
Umbraco CMS 13.x versions prior to 13.7.1
Umbraco backoffice API endpoints handling content and media permission checks

Discovery Timeline

2025-03-11 - CVE-2025-27602 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27602

Vulnerability Analysis

The vulnerability resides in the backoffice authorization handlers responsible for validating access to content and media items. Two handlers, ContentPermissionsQueryStringHandler and MediaPermissionsQueryStringHandler, resolve object keys from query string parameters before enforcing permission checks. Prior to the patch, these handlers did not restrict which Umbraco object type the supplied key could resolve to. An authenticated backoffice editor can substitute the identifier of a content or media node located in a folder outside their permitted scope, and the handler will resolve it without rejecting the request based on type or containment.

The result is an authorization bypass that allows retrieval or deletion of protected content and media. Because the attacker must already hold valid backoffice credentials, exploitation is limited to insiders or attackers who have obtained editor credentials through other means.

Root Cause

The root cause is missing type filtering during key parsing in the query string authorization handlers. Without a KeyParsingFilterType constraint, the handlers accepted any object key and evaluated permissions in a way that could be bypassed through URL parameter manipulation.

Attack Vector

Exploitation requires an authenticated session in the Umbraco backoffice with at least editor-level privileges. The attacker crafts an API request to a content or media endpoint and substitutes the identifier of an item in a folder they do not have access to. The server processes the request and returns or deletes the targeted item.

text

// Patch: src/Umbraco.Web.BackOffice/Authorization/ContentPermissionsQueryStringHandler.cs
 {
     private readonly ContentPermissions _contentPermissions;
 
+    protected override UmbracoObjectTypes KeyParsingFilterType => UmbracoObjectTypes.Document;
+
     /// <summary>
     ///     Initializes a new instance of the <see cref="ContentPermissionsQueryStringHandler" /> class.
     /// </summary>

// Patch: src/Umbraco.Web.BackOffice/Authorization/MediaPermissionsQueryStringHandler.cs
 {
     private readonly MediaPermissions _mediaPermissions;
 
+    protected override UmbracoObjectTypes KeyParsingFilterType => UmbracoObjectTypes.Media;
+
     /// <summary>
     ///     Initializes a new instance of the <see cref="MediaPermissionsQueryStringHandler" /> class.
     /// </summary>

Source: Umbraco-CMS commit 5b54bed and Umbraco-CMS commit 7888b9a. The fix introduces an explicit KeyParsingFilterType that restricts each handler to its intended object type, blocking cross-type key substitution.

Detection Methods for CVE-2025-27602

Indicators of Compromise

Backoffice API requests where the id, key, or parentId query string parameter references content or media outside the authenticated user's assigned start node.
Deletion or retrieval events in Umbraco audit logs affecting items whose parent folder is not in the acting user's permission scope.
Unexpected 200 OK responses on /umbraco/backoffice/UmbracoApi/Content/ or /Media/ endpoints for identifiers the user should not be able to access.

Detection Strategies

Correlate Umbraco backoffice audit log entries with each user's configured start node and permission set to flag out-of-scope content or media access.
Enable verbose logging on ContentPermissionsQueryStringHandler and MediaPermissionsQueryStringHandler to record permission evaluations against user identity.
Monitor HTTP traffic to backoffice API endpoints for parameter tampering patterns, particularly enumeration of sequential IDs or GUIDs.

Monitoring Recommendations

Alert on bulk DELETE or GET operations against content and media endpoints originating from non-administrator accounts.
Track failed and successful authorization decisions per user to identify accounts probing permission boundaries.
Retain Umbraco web server access logs long enough to support retrospective investigation of pre-patch activity.

How to Mitigate CVE-2025-27602

Immediate Actions Required

Upgrade Umbraco CMS to version 10.8.9, 13.7.1, or later immediately.
Review backoffice user accounts and revoke access for stale or unused editor accounts.
Audit content and media items for unauthorized modification or deletion since the vulnerability disclosure date.

Patch Information

The vulnerability is fixed in Umbraco CMS 10.8.9 and 13.7.1. The fix adds a KeyParsingFilterType property to both ContentPermissionsQueryStringHandler and MediaPermissionsQueryStringHandler, restricting key resolution to the correct UmbracoObjectTypes value. Refer to the GitHub Security Advisory GHSA-wx5h-wqfq-v698 for full advisory details.

Workarounds

No official workarounds are available. Applying the patch is the only supported remediation.
As a compensating control, limit backoffice access to trusted users and enforce multi-factor authentication for all editor accounts.
Restrict network access to the Umbraco backoffice to trusted management networks or a VPN until the patch can be deployed.

bash

# Example: verify installed Umbraco CMS version via dotnet CLI
dotnet list package | grep -i Umbraco.Cms

# Upgrade to a patched version
dotnet add package Umbraco.Cms --version 13.7.1
# or for the 10.x LTS branch
dotnet add package Umbraco.Cms --version 10.8.9