UpHeron
All vulnerabilities

Servers and applications

CVE-2025-24011

User Enumeration Feasible Based On Management API Timing and Response Codes

Severity
Medium 5.3
Published
21 Jan 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
14.3.2, 15.1.2
Also known as
GHSA-hmg4-wwm5-p999
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available.

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 14.0.0 before 14.3.2
  • From 15.0.0 before 15.1.2
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 14.0.0 before 14.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-24011
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-24011
  • GitHub Advisory Database https://github.com/advisories/GHSA-hmg4-wwm5-p999
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hmg4-wwm5-p999