CVE-2026-111624
Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
| CWE | CWE-306 |
| Vendor | umbraco |
| Product | umbraco-cms |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for umbraco umbraco-cms
Be the first to know when new low vulnerabilities affecting umbraco umbraco-cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
umbraco / Umbraco-CMS
17.0.0 < 17.7.1 18.0.0 < 18.2.1
References
github.com: https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7 github.com: https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHub.cs#L9-L11 github.com: https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHubUpdater.cs#L58 github.com: https://github.com/umbraco/Umbraco-CMS/commit/b4f6cfc9d0955f9d8443e68353db4a692e91bd94 github.com: https://github.com/umbraco/Umbraco-CMS/commit/243e082479c777d0f585bbd2f8db571607767b22 github.com: https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.2.1 github.com: https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.7.1 vulncheck.com: https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.1-and-18.2.1-missing-authorization-on-signalr-hubs
Credits
lichoin