{"id":"CVE-2026-111624","kind":"vulnerability","aliases":["CVE-2026-111624"],"related":[],"title":"Umbraco CMS: unauthenticated clients can read unpublished content notifications","description":"Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.","summary":"Umbraco CMS before 17.7.1 and 18.2.1 lets unauthenticated clients connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. An attacker can receive notifications that reveal content keys, including unpublished content, and the timing of editorial activity.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","dotnet","package","self-hosted","umbraco"],"not_affected_if":["managed-hosting","patched-version"],"how_to_check":"- Check the Umbraco CMS version in the project's package references, for example `Umbraco.Cms` in the .csproj file, and confirm whether it is below `17.7.1` or `18.2.1`.\n- Look for the PreviewHub and BackofficeHub SignalR hubs being reachable from the internet, for example by requesting their negotiate endpoints without logging in.","fix":"- Upgrade Umbraco CMS to `17.7.1` on the 17.x line or `18.2.1` on the 18.x line.","status":"open","published_at":"2026-10-16T18:17:42+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:01:55+00:00","updated_at":"2026-10-25T04:01:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:01:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Umbraco CMS to `17.7.1` on the 17.x line or `18.2.1` on the 18.x line.","reach":"internet","title":"Umbraco CMS: unauthenticated clients can read unpublished content notifications","impact":"low","summary":"Umbraco CMS before 17.7.1 and 18.2.1 lets unauthenticated clients connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. An attacker can receive notifications that reveal content keys, including unpublished content, and the timing of editorial activity.","category":"package","nicknames":[],"who_cares":["umbraco","dotnet","cms","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers read unpublished content keys and editorial activity timing.","analyst_note":"","how_to_check":"- Check the Umbraco CMS version in the project's package references, for example `Umbraco.Cms` in the .csproj file, and confirm whether it is below `17.7.1` or `18.2.1`.\n- Look for the PreviewHub and BackofficeHub SignalR hubs being reachable from the internet, for example by requesting their negotiate endpoints without logging in.","needs_analyst":false,"not_affected_if":["patched-version","managed-hosting"],"who_is_affected":"Sites running Umbraco CMS versions before 17.7.1 or 18.2.1 where the backoffice SignalR hubs can be reached by unauthenticated clients. The exposure is about information disclosure of content keys and editorial timing, not code execution. Sites already on the patched versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3360,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111624':12A,15A '-2026':11A,14A '17.7.1':26B,62C '18.2.1':28B,64C 'activ':58B,105C 'allow':71C 'attack':42B,84C 'author':68C 'backoffic':35B,78C 'backofficehub':38B,81C 'client':4A,31B,73C 'cms':2A,16B,24B,60C 'complet':86C 'connect':32B,75C 'contain':65C 'content':8A,48B,52B,97C,101C 'cve':10A,13A 'disclos':96C 'dotnet':17B 'editori':57B,104C 'host':21B 'hub':40B,83C 'includ':50B,99C 'key':49B,98C 'let':29B 'miss':67C 'negoti':89C 'notif':9A,45B,94C 'packag':18B 'previewhub':36B,79C 'read':6A 'receiv':44B,92C 'refresh':93C 'reveal':47B,103C 'self':20B 'self-host':19B 'signalr':39B,82C,88C 'step':90C 'time':55B,106C 'umbraco':1A,22B,23B,59C 'unauthent':3A,30B,72C 'unpublish':7A,51B,100C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Sites running Umbraco CMS versions before 17.7.1 or 18.2.1 where the backoffice SignalR hubs can be reached by unauthenticated clients. The exposure is about information disclosure of content keys and editorial timing, not code execution. Sites already on the patched versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111624","severity":null,"published_at":"2026-10-16T18:17:42+00:00","modified_at":"2026-10-21T21:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}