What’s Vulnerable › Vulnerabilities

CVE-2025-49147: Umbraco.Cms Vulnerable to Disclosure of Configured Password Requirements

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-24 · updated 2026-06-17
• Weakness: CWE-497

Description

Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The information available is limited but would perhaps give some additional detail useful for someone attempting to brute force derive a user's password. This information was not exposed in Umbraco 7 or 8, nor in 14 or higher versions. The vulnerability is patched in versions 10.8.11 and 13.9.2.

Affected products

• Umbraco-CMS: from 10.0.0 before 10.8.11; from 13.0.0 before 13.9.2 — fixed in 10.8.11, 13.9.2

How to fix

Upgrade to a fixed version: Umbraco-CMS 10.8.11, 13.9.2. Check the vendor advisory for mitigations.

References

• https://github.com/umbraco/Umbraco-CMS/commit/b4144564c836ec6929111ce2a12eb1f67b42d61e
• https://github.com/umbraco/Umbraco-CMS/commit/d8f68d2c40f8e158bd81d469f25ef3a4e1d86c4c
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-pgvc-6h2p-q4f6

Get alerted when CVE-2025-49147 or the next vulnerability affects your stack