CVE-2024-48925— Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-48925
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
Source: NVD (National Vulnerability Database)
Vulnerability Description
Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to version 14.3.0. The issue allows low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to the settings section. Version 14.3.0 contains a patch.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
访问控制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Umbraco CMS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Umbraco CMS是丹麦Umbraco公司的一个内容管理系统。 Umbraco CMS 14.0.0版本至14.3.0之前版本存在安全漏洞，该漏洞源于存在访问控制不当问题，允许低权限用户访问webhook API并检索应仅限于有权访问设置部分的用户的信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| umbraco | Umbraco-CMS | >= 14.0.0, < 14.3.0 | - |
II. Public POCs for CVE-2024-48925
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-48925
请登录查看更多情报信息。
Same Patch Batch · umbraco · 2024-10-22 · 5 CVEs total
| CVE-2024-48927 | 4.6 MEDIUM | Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice |
| CVE-2024-48929 | 4.2 MEDIUM | Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out |
| CVE-2024-48926 | 4.2 MEDIUM | Umbraco CMS logout page displayed before session expiration |
| CVE-2024-47819 | 4.2 MEDIUM | Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictiona |
IV. Related Vulnerabilities
Same product: Umbraco-CMS
- CVE-2026-31834
Umbraco Affected by Vertical Privilege Escalation via Missin - CVE-2026-31833
Umbraco has Stored XSS in UFM Rendering Pipeline via Permiss - CVE-2026-31832
Umbraco Backoffice API Allows Unauthorized Modification of D - CVE-2025-66625
Umbraco Vulnerable to Improper File Access and Credential Ex - CVE-2025-54425
Umbraco's Delivery API allows for cached requests to be retu
Same vendor: umbraco
- CVE-2026-31834
Umbraco Affected by Vertical Privilege Escalation via Missin - CVE-2026-31833
Umbraco has Stored XSS in UFM Rendering Pipeline via Permiss - CVE-2026-31832
Umbraco Backoffice API Allows Unauthorized Modification of D - CVE-2026-27449
Umbraco.Engage.Forms Allows Unauthorized Access to Multiple - CVE-2026-24687
Umbraco.Forms has path traversal and file enumeration vulner
Same weakness: CWE-284
- CVE-2026-8233
Dotouch XproUPF access control - CVE-2026-42569
phpvms: /importer authorization bypass causing full database - CVE-2026-42205
Avo: Broken Access Control: Unauthorized Execution of Arbitr - CVE-2026-41487
Langfuse: Improper role-based-access control in Langfuse LLM - CVE-2026-42278
UltraDAG: Smart Account Spending Policy Bypass via Pockets
V. Comments for CVE-2024-48925
No comments yet