Skip to content

Upgrading Umbraco.Cms.Web.BackOffice 9 to 10

Unknown9.5.4 → 10.8.11Security7

Full comparisonBack to Umbraco.Cms.Web.BackOffice
UnknownUpgrade verdict

DepDelta hasn't looked for the notes of 40 of 43 releases yet, so breaking changes can't be ruled out.

In plain terms
  • DepDelta hasn't finished looking for the notes in this range, so it can't rule out breaking changes yet.
  • Their commits are listed with this comparison.
Must act Top 3 of 7 that need code or config changes

Target frameworks requirement changed in 10.0.0-rc1: net5.0 → net6.0.

What you must change

Security7
Prevents disclosure of configured password requirements.
10.8.11GitHub ReleaseSummarizedView source
Prevents user enumeration based on the timing of login responses.
10.8.10GitHub ReleaseSummarizedView source
Fixes improper API access control that allowed low-privilege users access to data type functionality.
10.8.9GitHub ReleaseSummarizedView source
Fixes an issue where a restricted editor user could delete a media item or access unauthorized content.
Moderate · CVSS 4.9
10.8.9GitHub ReleaseSummarizedView source
Updates the ImageSharp dependency to a patched version following CVE-2025-27598.
ImageSharp
10.8.9GitHub ReleaseSummarizedView source
Umbraco CMS Open Redirect Bypass Protection
Moderate · CVSS 6.1
10.8.6GitHub AdvisoryOriginalView source
Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
High · CVSS 7.5
10.6.1GitHub AdvisoryOriginalView source