CVE-2026-111624
Received Received - Intake

Unauthenticated Access to Umbraco CMS SignalR Hubs

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111624
EUVD
EUVD-2026-103046

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
umbraco Umbraco-CMS 17.0.0
umbraco Umbraco-CMS 18.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111624 is a missing authorization vulnerability in Umbraco CMS versions before 17.7.1 and 18.2.1. It affects the PreviewHub and BackofficeHub SignalR hubs, allowing unauthenticated clients to connect by completing the SignalR negotiate step. Attackers can then receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.

Impact Analysis

This vulnerability allows attackers to observe limited editorial activity information such as content creation or editing events, including unpublished content, without authentication. It does not expose credentials, management capabilities, or permit changes to content. Publicly reachable Umbraco sites running affected versions are impacted.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart