CVE-2025-54425

Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such that the delivery API outputs will be cached for a period of time, improving performance. There's an issue when these two things are used together, where caching doesn't vary by the header that contains the API key. As such, it's possible for a user without a valid API key to retrieve a response for a given path and query if it has recently been requested and cached by request with a valid key. This is fixed in versions 13.9.3, 15.4.4 and 16.1.1.

• CWE-200

• https://docs.umbraco.com/umbraco-cms/reference/content-delivery-apiProduct
• https://github.com/umbraco/Umbraco-CMS/commit/7e82c258eebaa595eadc9b000461e27d02bc030ePatch
• https://github.com/umbraco/Umbraco-CMS/commit/9f37db18d11c8ba4e3ecdeb35291af30ebee7cd0Patch
• https://github.com/umbraco/Umbraco-CMS/commit/da43086017e1e318f6b5373391d78421efebce3aPatch
• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-75vq-qvhr-7ffrThird Party Advisory

Published

Jul 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5442A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-54420Rejected reason: This CVE is a duplicate of CVE-2025-8129.
• CVE-2025-54421NamelessMC is a free, easy to use & powerful website softwar…5.4
• CVE-2025-54422Sandboxie is a sandbox-based isolation software for 32-bit a…5.5
• CVE-2025-54423copyparty is a portable file server. In versions up to and i…6.1
• CVE-2025-544241Panel is a web interface and MCP Server that manages websit…9.8
• CVE-2025-54426Polkadot Frontier is an Ethereum and EVM compatibility layer…9.9
• CVE-2025-54427Polkadot Frontier is an Ethereum and EVM compatibility layer…6.9
• CVE-2025-54428RevelaCode is an AI-powered faith-tech project that decodes …9.8
• CVE-2025-54429Polkadot Frontier is an Ethereum and EVM compatibility layer…6.9
• CVE-2025-5443A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-54430dedupe is a python library that uses machine learning to per…9.1