Book a discovery call
Book a discovery call

Security Advisory, June 24, 2025: Security Patches is now available

We recommend you upgrade to the latest patch

Andy Butland
Written by Andy Butland

Summary: We have identified a moderate security vulnerability in Umbraco CMS 10 and 13, which allows anonymous access to details about configured password complexity. Today, we have released patches for the affected versions and recommend upgrading to the latest patch. Projects hosted on Umbraco Cloud will receive the fix automatically.

Who’s affected?

Versions affected:

  • Umbraco 13.0.0 - 13.9.1

  • Umbraco 10.0.0 - 10.8.10

Unsupported versions can be subject to the vulnerability, but will not receive a patch. We recommend upgrading to a supported major version.

Although Umbraco 10 is now EOL (end of life), as we received the report of the vulnerability within its support period, we are releasing this update for this version publicly.  If there are any further security patches for Umbraco 10, they will be released only under XLTS.

How to fix the vulnerability

Patches are available for the latest minor versions of Umbraco 10 and 13. As we are looking at a patch upgrade, and the fix is straightforward, we expect the update to only require minimal effort per project.

Instructions on patch availability and how to upgrade can be found in the release notes:

Automatic fix on Umbraco Cloud

All Umbraco Cloud sites running the latest minor version of a supported version are patched via the automated patch feature. The security patches will be rolled out to Umbraco Cloud today to ensure all sites have been fixed.

If a project is not running the latest minor version (10.8.x, 13.9.x), the patch can be applied using the minor upgrade feature.

Screenshot form the Umbraco Cloud Portal showing the option to turn on Automatic Minor Upgrades

ℹ️ Note that Umbraco Cloud also supports automated minor upgrades. This can be enabled on a per-project level and ensures you're always ready to receive the latest patch.

What we know about the vulnerability

Exploiting the vulnerability requires the user to discover an anonymous API endpoint from which details of the password configuration for backoffice users can be read. There is no access to passwords themselves.  However, this does provide information on the password complexity enforced on the site, which could be of use to someone attempting brute force access.

For more details, please refer to the security advisory:

Any questions?

If you have any questions or comments about this advisory, make sure to get in touch with us directly on the Security Advisories. Alternatively, you can reach out to the dedicated security email address listed at https://umbraco.com/security. Here you can also find information on how we handle security-related issues.For direct communication related to security in Umbraco products, please sign up for the dedicated security mailing list.