July 2025: the Delivery API cache that forgot to check the API key

· JD + AI · Umbraco

July 2025: the Delivery API cache that forgot to check the API key

If you serve content through Umbraco's Content Delivery API, restricted behind an API key, with output caching switched on, you had a hole open for most of July. The patches landed on the 29th.

That is the month's only urgent item, and the precondition is worth reading twice because most installs do not meet it. What makes it worth your attention is the shape of the bug, not its severity.

The cache did not vary on the header that authorised the request

Security Advisory, July 29, 2025 — Andy Butland, writing on Umbraco's own blog

Umbraco rates it moderate. Affected: 13.0.0–13.9.2, 15.0.0–15.4.3, 16.0.0–16.1.0. The Delivery API arrived in Umbraco 12, so everything from there forward is in range if the feature is on. Fixes are 13.9.3, 15.4.4 and 16.1.1, all patch-level, and Cloud projects running the latest minor were patched automatically that day.

The mechanism is the interesting part. The advisory says "the caching doesn't vary by the header that contains the API key". Response caching keyed on path and query, authorisation carried in a header, and the two features compose into a cache that will hand a previously authorised response to a caller with no valid key. Published and draft content both. Umbraco says internal testing found it; the detail sits in GHSA-75vq-qvhr-7ffr.

Neither feature is wrong on its own. That is the point. If you inherited a headless Umbraco build from another agency, "did anyone enable Delivery API output caching" is now a question with a wrong answer.

uSync shipped three times in nine days, and all of it was v13 upgrade debt

Kevin Jump released v16.0.1 on 15 July, v13.3.0 on the 22nd and v16.0.2 on the 23rd. Read together they map where the v13 to v16 move still bleeds.

16.0.1 is fixes "around migrating RTE values with block elements in them from v13 sites", in his words, and the changelog shows block-level recursion added to the rich-text mappers. So if your content types crossed over with rich-text blocks mangled, you were not holding it wrong. The mapper did not descend into blocks until that release. 13.3.0 extends the roots feature with an ISyncFile interface, which is what lets you pull folders from packages and sibling projects into one sync tree. 16.0.2 fixes the member group picker and cuts false positives out of the XML compare on roots.

Three releases from one maintainer, in nine days, covering the upgrade path that most migration work in this ecosystem runs through. That is not a complaint about him.

The roadmap post named MCP; one blogger had already wired it to two CMSs

What's Next for Umbraco — Filip Bech-Larsen, CTO, on Umbraco's own blog — is the vendor stating intent about its own products, so read it as intent rather than commitment. It names four things: the community MCP server becoming the official one with a stable release close; Umbraco Compose, an unreleased SaaS product for orchestrating data, in private beta; a search abstraction layer with webhooks and third-party integrations next; and a rebuilt Engage backoffice ahead of the next LTS. No dates attach to any of it.

Then there is No-code content sync with MCP servers for Sitecore and Umbraco, on jeroenbreuer.nl. Our record carries no byline for that page; the only place a name appears is the site's own strapline, which names Jeroen Breuer, and we are not going to promote a strapline to a byline. Whoever wrote it: two MCP servers, one JSON config block, two chat prompts, and an FAQ item moves from Umbraco to Sitecore and back with no mapping code. Five hundred words that demonstrate the roadmap better than the roadmap post does.

If you are deciding whether MCP is real for content operations yet, that post is the honest picture. Credentials sitting in plaintext in the config. Calls retrying because the first payload did not match the target schema. Good enough to prove the idea, nowhere near a migration tool.

Three of the month's fourteen items were Codegarden recaps, and both personal ones came from Umbraco staff

The conference was in June. The write-ups arrived in July, which is normal, and so is the fact that they are affectionate. What is worth naming is who wrote them.

Codegarden 2025 — Rick Butterfield — is the fuller account, and in it he announces he had been offered a job at Umbraco HQ on the Commercial Products team, starting 1 September. Codegarden 2025: A Community, Not a Cult! — Corné Hoskam — was written from inside HQ; he describes attending as crew rather than as an MVP. Both are honest about it and neither is hiding anything. But the public account of the vendor's conference, a month on, is substantially the vendor's own. The facts that survive that: Compose and the official MCP server were the two keynote announcements, and Butterfield's remark that the product segment "felt a bit too long this year" is the sharpest criticism anybody published.

The third recap, Web Hacking 101 — Steven Harland, on Umbraco's blog — covers a Burp Suite workshop built around a deliberately vulnerable Umbraco application, run out of the Umbraco Community Security and Privacy Team's work. Read it next to the advisory above.

The fourth Umbraco-blog item, What Lithuania Can Teach Us About Enterprise Cybersecurity by Zoja Antuchevič, CEO and Partner at SOLUTIONLAB PRODUCTION, is a guest post about national cyber policy that never mentions the CMS. It is in this list because it was in the window, not because it changes anything you do on Monday.

The field notes are where July earned its keep

Adding 2FA (+ recovery codes) for Umbraco Members — Rick Butterfield — is the most useful thing published this month. Member two-factor is documented; recovery codes are not, and he traces the gap to documentation "assuming you'll use Umbraco's built in methods that aren't very visible". Working code is in a public repo. It is written against v13 and he has not tried it on v16, so confirm before you lift it.

The quickest way to add a custom font to the new Umbraco backoffice — same author — is four hundred words on why Shadow DOM eats your brand font in block previews, and the backofficeEntryPoint manifest that loads the stylesheet early enough to cascade. Anyone running BlockPreview on a client site has hit this and blamed something else.

How I Saved 5GB of Storage Per Year for UMB.FYI — Matt Brailsford, who edits the UMB.FYI newsletter he is writing about — is 215KB of HTML for a text-only email, caused by global CSS selectors being inlined onto every matching element, against Gmail's ~102KB clipping threshold. Not an Umbraco problem, but one that anyone sending mail generated out of Umbraco will eventually meet. UMB.FYI Gets an iOS Tip Shortcut, same author, adds a share-sheet shortcut for submitting links to it.

What we're watching

July's one real risk came from two features that are each safe alone and unsafe together. That is not a coding mistake, it is a composition mistake, and composition mistakes are what layered, API-first architectures produce structurally. You cannot find them by reviewing either feature.

Which is the uncomfortable thing about the roadmap in the same month. Compose orchestrating external data, MCP servers writing into the CMS from a chat window, search spanning systems the CMS does not own: every one of those is another pair of features that are safe alone. The Delivery API advisory is small. The class it belongs to is not, and it is the class Umbraco is building more of.

Meanwhile the upgrade path that carries this ecosystem's migration work is one person's package, patched three times in nine days. If you have budget for a v13 to v16 move, some of it should reach Kevin Jump.

Sources

umbraco · umbraco-cms · umbraco-apis · umbraco-cloud · deployment · product · community · release

2026 © Umbracolombia - All rights reserved.