CVE-2025-49147: Umbraco CMS Information Disclosure Flaw

CVE-2025-49147 Overview

CVE-2025-49147 is an information disclosure vulnerability in Umbraco CMS, an open source .NET content management system. The flaw affects versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. An unauthenticated attacker can send a request to an anonymously accessible endpoint and retrieve details about the configured password policy. The exposed data is limited but reveals password requirements that could assist an attacker attempting to brute force user credentials. Earlier releases (Umbraco 7 and 8) and later releases (14 and above) do not expose this information. The issue is tracked under CWE-497: Exposure of Sensitive System Information.

Critical Impact
Unauthenticated remote attackers can enumerate password policy configuration to refine brute-force and credential-stuffing attacks against Umbraco user accounts.

Affected Products

Umbraco CMS versions 10.0.0 through 10.8.10
Umbraco CMS versions 13.0.0 through 13.9.1
Deployments exposing anonymous endpoints to untrusted networks

Discovery Timeline

2025-06-24 - CVE-2025-49147 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49147

Vulnerability Analysis

The vulnerability resides in an anonymously authenticated endpoint that returns the current password policy configuration. When an attacker issues a crafted HTTP request to this endpoint, the server responds with details about the minimum password length, character class requirements, and related policy attributes. Because no authentication is enforced, any network-reachable client can query this data.

The exposed policy information is not directly exploitable on its own, but it materially assists credential-guessing attacks. Knowing the exact password composition rules lets an attacker prune candidate wordlists to only strings that satisfy the policy. This reduces the search space for online brute-force attempts and offline credential-stuffing campaigns.

The issue is classified under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. The vulnerability was introduced in the Umbraco 10 branch and carried forward into the 13 branch. Version 14 and later refactored the affected code path and are not impacted.

Root Cause

The root cause is missing access control on the endpoint that returns password policy metadata. Configuration information intended for authenticated administrative flows is served to anonymous callers. The application does not enforce an authorization check before returning the sensitive settings payload.

Attack Vector

Exploitation requires only network access to the Umbraco backoffice. An attacker sends an HTTP request to the vulnerable endpoint and parses the JSON response to extract password policy fields. No user interaction or credentials are needed. The retrieved values are then fed into brute-force or dictionary tooling targeting known Umbraco usernames. Technical details are available in the GHSA-pgvc-6h2p-q4f6 advisory.

Detection Methods for CVE-2025-49147

Indicators of Compromise

Anonymous HTTP GET requests to Umbraco backoffice password policy endpoints originating from external IP addresses
Bursts of failed authentication attempts against /umbraco login endpoints following reconnaissance requests
Requests from clients that do not present a valid backoffice session cookie or bearer token

Detection Strategies

Review web server and application logs for unauthenticated requests to Umbraco backoffice API paths
Correlate password policy endpoint access with subsequent authentication failure spikes from the same source
Deploy web application firewall rules that log or block anonymous access to administrative API routes

Monitoring Recommendations

Alert on any anonymous request that returns HTTP 200 from Umbraco backoffice endpoints
Track authentication failure counts per source IP and per targeted username
Monitor for scanning patterns that enumerate /umbraco/backoffice/ URIs prior to login attempts

How to Mitigate CVE-2025-49147

Immediate Actions Required

Upgrade Umbraco CMS to version 10.8.11 or 13.9.2, or migrate to version 14 or later
Restrict access to the /umbraco backoffice path to trusted networks or via VPN until patching is complete
Enforce account lockout thresholds and rate limiting on authentication endpoints
Audit backoffice user accounts and require rotation of weak or reused passwords

Patch Information

Umbraco released fixes in versions 10.8.11 and 13.9.2. The corrective changes are published in the Umbraco-CMS commit b4144564 and the Umbraco-CMS commit d8f68d2c. Full details are documented in the GitHub Security Advisory GHSA-pgvc-6h2p-q4f6.

Workarounds

Block anonymous access to the affected password policy endpoint at a reverse proxy or WAF layer
Place the Umbraco backoffice behind network-level access controls such as IP allowlisting
Enable multi-factor authentication for all backoffice users to reduce impact of credential guessing

bash

# Example NGINX rule to restrict backoffice access to a trusted network
location /umbraco/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://umbraco_backend;
}