Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

umbraco.cms.api.delivery

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3NuGetPublished

    Umbraco Delivery API allows for cached requests to be returned with an invalid API key

    CVE-2025-54425 · GHSA-75vq-qvhr-7ffr

    Affected
    • NuGet umbraco.cms.api.delivery >= 13.0.0, <= 13.9.2; >= 15.0.0, <= 15.4.3; >= 16.0.0, <= 16.1.0
    Fixed in
    15.4.416.1.113.9.3· Vendor fix available
    Issue
    Impact Umbraco's content delivery API can be restricted from public access such that an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such that the delivery API outputs will be cached for a period of time, improving performance. There's an issue when these two things are used together though in that the caching doesn't vary by the header that contains the API key. As such it's possible for a user without a valid API key to retrieve a response for a given path and query if it has recently been requested and cached by request with a valid key. Patches Patches will be available in 13.9.3, 15.4.4 and 16.1.1. Workarounds Workaround is to remove or reduce the time period of the output caching or to provide other restrictions to access the delivery API such as by IP. References Content delivery API documentation: https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api

    Recommended action: Upgrade to 16.1.1, 15.4.4 or 13.9.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →