CVE-2026-111624
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Access to Umbraco CMS SignalR Hubs

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111624
EUVD
EUVD-2026-103046

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
umbraco Umbraco-CMS 17.0.0
umbraco Umbraco-CMS 18.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111624 is a missing authorization vulnerability in Umbraco CMS versions before 17.7.1 and 18.2.1. It affects the PreviewHub and BackofficeHub SignalR hubs, allowing unauthenticated clients to connect by completing the SignalR negotiate step. Attackers can then receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.

Detection Guidance

To detect this vulnerability, check if your Umbraco CMS version is between 17.0.0-17.7.0 or 18.0.0-18.2.0. Use commands like curl to test SignalR hub endpoints for unauthenticated access. For example, run: curl -v http://<umbraco-site>/umbraco/backoffice/backofficehub/negotiate and curl -v http://<umbraco-site>/umbraco/backoffice/previewhub/negotiate. If these return valid responses without authentication, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to observe limited editorial activity information such as content creation or editing events, including unpublished content, without authentication. It does not expose credentials, management capabilities, or permit changes to content. Publicly reachable Umbraco sites running affected versions are impacted.

Compliance Impact

This vulnerability may expose unpublished content and editorial activity timing, which could potentially violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., exposure of sensitive health information). The disclosure of such data without proper authorization could lead to compliance breaches.

Mitigation Strategies

Immediately upgrade Umbraco CMS to version 17.7.1 or 18.2.1 or later. As a temporary measure, restrict network access to Umbraco back-office paths using firewalls, reverse proxies, or WAFs. Ensure SignalR hub endpoints require authentication by verifying the BackOfficeAccess policy is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart