CVE-2026-111624GHSA-4c5q-6c64-96j7
Umbraco-CMS: Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
umbraco Umbraco-CMS
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
Text from CVE List
Affected versions 2
- Umbraco-CMSaffected: 17.0.0 before 17.7.1CVE List
- Umbraco-CMSaffected: 18.0.0 before 18.2.1CVE List
References 8
- github.com/umbraco/Umbraco-CMS/commit/b4f6cfc9d0955f9d8443e68353db4a692e91bd94Fixvia CVE List
- github.com/umbraco/Umbraco-CMS/commit/243e082479c777d0f585bbd2f8db571607767b22Fixvia CVE List
- github.com/umbraco/Umbraco-CMS/releases/tag/release-18.2.1Fixvia CVE List
- github.com/umbraco/Umbraco-CMS/releases/tag/release-17.7.1Fixvia CVE List
- github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7Advisoryvia CVE List
- vulncheck.com/advisories/umbraco-cms-before-17.7.1-and-18.2.1-missing-authorization-on-signalr-hubsAdvisoryvia CVE List
- github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHub.cs#L9-L11Referencevia CVE List
- github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHubUpdater.cs#L58Referencevia CVE List