{"schema":"threatline.record/2","record":{"id":"GHSA-4c5q-6c64-96j7","aliases":["GHSA-4c5q-6c64-96j7"],"summary":"Unauthenticated SignalR hubs disclose content identifiers and editorial activity","details":"### Impact\r\n\r\nCertain real-time communication endpoints used by the Umbraco back office could be accessed without authentication. A client with network access to an affected site could connect to these endpoints and receive limited information about editorial activity in the back office, such as the fact that content was being created or edited, including unpublished content, and when.\r\n\r\nThe exposure is limited to this activity information. No content, credentials or management capabilities are exposed, and the issue does not allow content to be changed.\r\n\r\nEvery publicly reachable Umbraco site running an affected version is impacted. No authentication or prior access is required.\r\n\r\n### Patches\r\n\r\nThe affected endpoints now require authentication, consistent with other back-office endpoints. Authenticated back-office users are not affected by the change, and features such as content preview continue to work as before.\r\n\r\nUpgrade to the following versions or later: 17.7.1 and 18.2.1.\r\n\r\n### Workarounds\r\n\r\nThere is no configuration setting that resolves this issue, so upgrading is the recommended remediation.\r\n\r\nAs an interim measure, restrict network access to the Umbraco back office paths to trusted networks at your reverse proxy, firewall or WAF. Take care that any restriction does not interfere with back-office features that editors rely on, such as content preview.","categories":["Unclassified"],"product":"Umbraco.Cms","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7","source_modified_at":"2026-10-06T07:11:45Z","fetched_at":"2026-10-27T10:24:27.527526Z","package":{"ecosystem":"nuget","name":"Umbraco.Cms"},"range":">=17.0.0, <= 17.7.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7","source_modified_at":"2026-10-06T07:11:45Z","fetched_at":"2026-10-27T10:24:27.527526Z","package":{"ecosystem":"nuget","name":"Umbraco.Cms"},"range":">=18.0.0, <= 18.2.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7","source_modified_at":"2026-10-06T07:11:45Z","fetched_at":"2026-10-27T10:24:27.527526Z","package":{"ecosystem":"nuget","name":"Umbraco.Cms"},"version":"17.7.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7","source_modified_at":"2026-10-06T07:11:45Z","fetched_at":"2026-10-27T10:24:27.527526Z","package":{"ecosystem":"nuget","name":"Umbraco.Cms"},"version":"18.2.1"}],"cvss":3.7,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-06T05:08:38Z","modified_at":"2026-10-06T07:11:45Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7","fetched_at":"2026-10-27T10:24:27.527526Z","source_modified_at":"2026-10-06T07:11:45Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T07:11:45Z","content_hash":"b79269d8d6040bfeed3af750a57cfe657c5b3fecdefa5a5378f39db657c27166"}}