{
  "schema_version": "1.4.0",
  "id": "GHSA-6ffg-mjg7-585x",
  "modified": "2025-03-12T14:40:21Z",
  "published": "2025-03-11T15:27:28Z",
  "aliases": [
    "CVE-2025-27601"
  ],
  "summary": "Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality",
  "details": "### Impact\nAn improper API access control issue has been identified, allowing low-privilege, authenticated users to create and update data type information that should be restricted to users with access to the settings section.\n\n### Patches\nWill be patched in 14.3.3 and 15.2.3.\n\n### Workarounds\nNone available.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Cms.Api.Management"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "15.0.0-rc1"
            },
            {
              "fixed": "15.2.3"
            }
          ]
        }
      ],
      "database_specific": {
        "last_known_affected_version_range": "<= 15.2.2"
      }
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Cms.Api.Management"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.3.3"
            }
          ]
        }
      ],
      "database_specific": {
        "last_known_affected_version_range": "<= 14.3.2"
      }
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6ffg-mjg7-585x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27601"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/commit/d9fb6df16e9adf8656181cac8497fc5ba23321cd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco-CMS/commit/ebb6a580dc1da2c772a99838dc7b4660bf77eb9c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/umbraco/Umbraco-CMS"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-11T15:27:28Z",
    "nvd_published_at": "2025-03-11T16:15:17Z"
  }
}