CVE-2025-54425

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-54425
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54425.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54425
Aliases
Published
2025-07-30T13:41:07Z
Modified
2026-08-12T03:51:22Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Umbraco's Delivery API allows for cached requests to be returned with an invalid API key
Details

Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such that the delivery API outputs will be cached for a period of time, improving performance. There's an issue when these two things are used together, where caching doesn't vary by the header that contains the API key. As such, it's possible for a user without a valid API key to retrieve a response for a given path and query if it has recently been requested and cached by request with a valid key. This is fixed in versions 13.9.3, 15.4.4 and 16.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54425.json"
}
References

Affected packages

Git / github.com/umbraco/umbraco-cms

Affected ranges

Type
GIT
Repo
https://github.com/umbraco/umbraco-cms
Events
Introduced
9dfb3005bcd68f5399ee13263bfc462c69b39a66
Fixed
9f37db18d11c8ba4e3ecdeb35291af30ebee7cd0
Introduced
76ed1707537e8f0dcf13ae7a84d2af60d1aa1816
Fixed
da43086017e1e318f6b5373391d78421efebce3a
Introduced
9812630bb4664026150732d850d56672b178fa2e
Fixed
7e82c258eebaa595eadc9b000461e27d02bc030e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "13.0.0"
        },
        {
            "fixed": "13.9.3"
        },
        {
            "introduced": "15.0.0"
        },
        {
            "fixed": "15.4.4"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.1.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54425.json"