MEDIUM4.3
GHSA-6ffg-mjg7-585x
Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
Quick fix
GHSA-6ffg-mjg7-585x — Umbraco.Cms.Api.Management: upgrade to the fixed version with the command below.
dotnet add package Umbraco.Cms.Api.Management --version 15.2.3Details
### Impact An improper API access control issue has been identified, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section.
### Patches Will be patched in 14.3.3 and 15.2.3.
### Workarounds None available.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/Umbraco.Cms.Api.Management
Introduced in:
15.0.0-rc1Fixed in: 15.2.3Fix
dotnet add package Umbraco.Cms.Api.Management --version 15.2.3NuGet/Umbraco.Cms.Api.Management
Introduced in:
0Fixed in: 14.3.3Fix
dotnet add package Umbraco.Cms.Api.Management --version 14.3.3References
- https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2025-27601[ADVISORY]
- https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd[WEB]
- https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c[WEB]
- https://github.com/umbraco/Umbraco-CMS[PACKAGE]