CVE-2026-111624: Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
Affected Software
Event History
Frequently Asked Questions
Which Umbraco CMS versions require remediation?
Umbraco CMS versions earlier than 17.7.1 and 18.2.1 are affected. Upgrading to the applicable fixed version addresses the issue.
Does exploitation require an authenticated backoffice account?
No. Unauthenticated clients can connect to the affected SignalR hubs and complete the SignalR negotiate step.
What information can be exposed through the affected hubs?
Refreshed notifications can disclose content keys, including keys for unpublished content. They can also reveal the timing of editorial activity.