Umbraco.Cms: Unauthenticated SignalR hubs disclose content identifiers and editorial activity

Impact

Certain real-time communication endpoints used by the Umbraco back office could be accessed without authentication. A client with network access to an affected site could connect to these endpoints and receive limited information about editorial activity in the back office, such as the fact that content was being created or edited, including unpublished content, and when.

The exposure is limited to this activity information. No content, credentials or management capabilities are exposed, and the issue does not allow content to be changed.

Every publicly reachable Umbraco site running an affected version is impacted. No authentication or prior access is required.

Patches

The affected endpoints now require authentication, consistent with other back-office endpoints. Authenticated back-office users are not affected by the change, and features such as content preview continue to work as before.

Upgrade to the following versions or later: 17.7.1 and 18.2.1.

Workarounds

There is no configuration setting that resolves this issue, so upgrading is the recommended remediation.

As an interim measure, restrict network access to the Umbraco back office paths to trusted networks at your reverse proxy, firewall or WAF. Take care that any restriction does not interfere with back-office features that editors rely on, such as content preview.