What is GHSA-wx5h-wqfq-v698?

GHSA-wx5h-wqfq-v698 is a security advisory published by GitHub Security Advisories with Medium severity. Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Which CVE IDs does GHSA-wx5h-wqfq-v698 cover?

GHSA-wx5h-wqfq-v698 covers the following CVE IDs: CVE-2025-27602. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wx5h-wqfq-v698?

GHSA-wx5h-wqfq-v698 has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

Which products are affected by GHSA-wx5h-wqfq-v698?

GHSA-wx5h-wqfq-v698 affects 2 products, including: nuget/Umbraco.Cms.Web.Backoffice:\u003c= 10.8.8; nuget/Umbraco.Cms.Web.Backoffice:\u003e= 11.0.0-rc1, \u003c= 13.7.0.

GHSA-wx5h-wqfq-v698MediumCVSS 4.9

Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Vendor

GitHub Security Advisories

Published

March 11, 2025

Last Modified

March 12, 2025

🔗 CVE IDs covered (1)

CVE-2025-27602 →

📋 Description

Impact

Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to.

Patches

Will be patched in 10.8.9 and 13.7.1

Workarounds

None available.

🎯 Affected products2

nuget/Umbraco.Cms.Web.Backoffice:<= 10.8.8
nuget/Umbraco.Cms.Web.Backoffice:>= 11.0.0-rc1, <= 13.7.0

🔗 References (5)

https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-wx5h-wqfq-v698
https://github.com/umbraco/Umbraco-CMS/commit/5b54bed406682ceff57903bf7d3c57814eef31a7
https://github.com/umbraco/Umbraco-CMS/commit/7888b9a4ce5ae7f9bda7ff3bb705b8fcd2f1675d
https://nvd.nist.gov/vuln/detail/CVE-2025-27602
https://github.com/advisories/GHSA-wx5h-wqfq-v698