Live › vulnerability › CVE-2026-111624
Go to dashboardUmbraco CMS before 17.7.1 and 18.2.1 lets unauthenticated clients connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. An attacker can receive notifications that reveal content keys, including unpublished content, and the timing of editorial activity.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Umbraco CMS versions before 17.7.1 or 18.2.1 where the backoffice SignalR hubs can be reached by unauthenticated clients. The exposure is about information disclosure of content keys and editorial timing, not code execution. Sites already on the patched versions can skip it.
No product ranges from the sources yet.
Umbraco.Cms in the .csproj file, and confirm whether it is below 17.7.1 or 18.2.1.17.7.1 on the 17.x line or 18.2.1 on the 18.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
This page as .md · .json · in your agent: get_signal("CVE-2026-111624")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.