Loading...
Skip to main content
GeekWala

CVE-2025-24011 — Vulnerability in Umbraco.Cms — CVE Details

MEDIUM

Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes

Published January 21, 2025Updated April 17, 2025Source: osv

Summary

### Impact Based on an analysis of response codes and timing of Umbraco 14+ management API responses, it's possible to determine whether an account exists. ### Patches Patched in 14.3.2 and 15.1.2. ### Workarounds None available.

Advisory Timeline

  • First published January 21, 2025 (629 days ago).
  • Last revised April 17, 2025 — 86 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update Umbraco.Cms to 15.1.2 or later
dotnet add package Umbraco.Cms --version 15.1.2
NuGet
Update Umbraco.Cms to 14.3.2 or later
dotnet add package Umbraco.Cms --version 14.3.2

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: nuget (1).

PackageEcosystemAffectedFixed In
Umbraco.Cms
nuget
15.0.0, 15.1.0, 15.1.0-rc, 15.1.0-rc2 (+1 more)15.1.2
Umbraco.Cms
nuget
14.0.0, 14.1.0, 14.1.0-rc, 14.1.0-rc2 (+9 more)14.3.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 5.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Frequently Asked Questions

What is CVE-2025-24011?
Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.3/10).
How do I check if my project is affected by CVE-2025-24011?
CVE-2025-24011 affects Umbraco.Cms. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-24011 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
5.3

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-hmg4-wwm5-p999

Related CVEs

  • CVE-2025-32017
    HIGH

    Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

  • CVE-2026-31834
    HIGH

    Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

  • CVE-2026-69197
    HIGH

    Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

  • CVE-2015-8813
    HIGH

    Umbraco CMS vulnerable to CSRF

  • CVE-2026-46616
    MEDIUM

    Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

  • CVE-2025-46736
    MEDIUM

    Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

  • CVE-2026-46609
    MEDIUM

    Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

  • CVE-2026-31833
    MEDIUM

    Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies