GHSA-75vq-qvhr-7ffr

Suggest an improvement
Source
https://github.com/advisories/GHSA-75vq-qvhr-7ffr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-75vq-qvhr-7ffr/GHSA-75vq-qvhr-7ffr.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-75vq-qvhr-7ffr
Aliases
Published
2025-07-29T19:10:39Z
Modified
2025-07-30T16:02:38.824820Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Umbraco Delivery API allows for cached requests to be returned with an invalid API key
Details

Impact

Umbraco's content delivery API can be restricted from public access such that an API key must be provided in a header to authorize the request.

It's also possible to configure output caching, such that the delivery API outputs will be cached for a period of time, improving performance.

There's an issue when these two things are used together though in that the caching doesn't vary by the header that contains the API key. As such it's possible for a user without a valid API key to retrieve a response for a given path and query if it has recently been requested and cached by request with a valid key.

Patches

Patches will be available in 13.9.3, 15.4.4 and 16.1.1.

Workarounds

Workaround is to remove or reduce the time period of the output caching or to provide other restrictions to access the delivery API such as by IP.

References

Content delivery API documentation: https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api

Database specific 
{
    "github_reviewed": true,
    "severity": "MODERATE",
    "github_reviewed_at": "2025-07-29T19:10:39Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "nvd_published_at": "2025-07-30T14:15:29Z"
}
References

Affected packages

NuGet / Umbraco.Cms.Api.Delivery

Package

Name
Umbraco.Cms.Api.Delivery
View open source insights on deps.dev
Purl
pkg:nuget/Umbraco.Cms.Api.Delivery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13.0.0
Fixed
13.9.3

Affected versions

13.*

13.0.0
13.0.1
13.0.2
13.0.3
13.1.0-rc
13.1.0
13.1.1
13.2.0-rc
13.2.0
13.2.1
13.2.2
13.3.0-rc
13.3.0
13.3.1
13.3.2
13.4.0-rc
13.4.0-rc2
13.4.0
13.4.1
13.5.0-rc
13.5.0
13.5.1
13.5.2
13.5.3
13.6.0-rc
13.6.0-rc2
13.6.0
13.7.0-rc
13.7.0
13.7.1
13.7.2
13.8.0-rc
13.8.0
13.8.1
13.9.0-rc
13.9.0
13.9.1
13.9.2

Database specific 

{
    "last_known_affected_version_range": "<= 13.9.2"
}

NuGet / Umbraco.Cms.Api.Delivery

Package

Name
Umbraco.Cms.Api.Delivery
View open source insights on deps.dev
Purl
pkg:nuget/Umbraco.Cms.Api.Delivery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15.0.0
Fixed
15.4.4

Affected versions

15.*

15.0.0
15.1.0-rc
15.1.0-rc2
15.1.0
15.1.1
15.1.2
15.2.0-rc
15.2.0
15.2.1
15.2.2
15.2.3
15.3.0-rc
15.3.0-rc2
15.3.0
15.3.1
15.4.0-rc
15.4.0-rc2
15.4.0
15.4.1
15.4.2
15.4.3

Database specific 

{
    "last_known_affected_version_range": "<= 15.4.3"
}

NuGet / Umbraco.Cms.Api.Delivery

Package

Name
Umbraco.Cms.Api.Delivery
View open source insights on deps.dev
Purl
pkg:nuget/Umbraco.Cms.Api.Delivery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16.0.0
Fixed
16.1.1

Affected versions

16.*

16.0.0
16.1.0-rc
16.1.0

Database specific 

{
    "last_known_affected_version_range": "<= 16.1.0"
}