UpHeron
All vulnerabilities

Servers and applications

CVE-2025-49147

Disclosure of Configured Password Requirements

Severity
Medium 5.3
Published
24 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.8.11, 13.9.2
Also known as
GHSA-pgvc-6h2p-q4f6
Sources
NVD, Project advisories (GitHub)

Description

Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The information available is limited but would perhaps give some additional detail useful for someone attempting to…

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 10.0.0 before 10.8.11
  • From 13.0.0 before 13.9.2
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 10.0.0 before 10.8.11
  • From 13.0.0 before 13.9.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-49147
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-49147
  • GitHub Advisory Database https://github.com/advisories/GHSA-pgvc-6h2p-q4f6
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-pgvc-6h2p-q4f6