CVE-2025-24011 Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
Attackers can enumerate valid user accounts by analyzing response codes and timing in the Umbraco management API, requiring a patch to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24011?
CVE-2025-24011 is a medium-severity vulnerability in Umbraco Umbraco Cms, published on 21 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and 15.1.2 contain a patch. No known workarounds are available.
Which versions are affected by CVE-2025-24011?
4 open source packages ship an affected version, including Umbraco.Cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Umbraco.Cms NuGet | From 14.0.0 | 14.3.2 |
Umbraco.Cms NuGet | From 14.0.0 | 14.3.2 |
Umbraco.Cms NuGet | From 15.0.0 | 15.1.2 |
Umbraco.Cms NuGet | From 15.0.0 | 15.1.2 |
Products include Umbraco Umbraco Cms.
How do I fix CVE-2025-24011?
Upgrade Umbraco.Cms to a fixed version for your release line: 14.3.2 or 15.1.2.
Is CVE-2025-24011 being exploited?
There is no known exploitation of CVE-2025-24011 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Umbraco Umbraco Cms
- CVE-2025-67288 Umbraco CMS has an arbitrary file upload vulnerability
- CVE-2014-10074 File upload in n/a
- CVE-2012-1301 Server-side request forgery in n/a
- CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
- CVE-2025-32017 Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users
Sources
Also known as GHSA-hmg4-wwm5-p999.