UpHeron
All vulnerabilities

Servers and applications

CVE-2025-54425

Delivery API allows for cached requests to be returned with an invalid API key

Severity
Medium 5.3
Published
29 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
13.9.3, 15.4.4, 16.1.1
Also known as
GHSA-75vq-qvhr-7ffr
Sources
NVD, Project advisories (GitHub)

Description

Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such that the delivery API outputs will be cached for a period of time, improving performance. There's an…

Affected software

SoftwareAffected versions
Umbraco CMSServers and applications · cpe:a:umbraco:umbraco_cms
  • From 13.0.0 before 13.9.3
  • From 15.0.0 before 15.4.4
  • From 16.0.0 before 16.1.1
Umbraco CMSServers and applications · github:umbraco/umbraco-cms
  • From 13.0.0 before 13.9.3
  • From 15.0.0 before 15.4.4
  • From 16.0.0 before 16.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-54425
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54425
  • GitHub Advisory Database https://github.com/advisories/GHSA-75vq-qvhr-7ffr
  • github.com https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-75vq-qvhr-7ffr