---
id: "CVE-2026-111624"
kind: "vulnerability"
aliases: ["CVE-2026-111624"]
title: "Umbraco CMS: unauthenticated clients can read unpublished content notifications"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "dotnet", "package", "self-hosted", "umbraco"]
not_affected_if: ["managed-hosting", "patched-version"]
published_at: "2026-10-16T18:17:42+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:01:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111624", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Umbraco CMS: unauthenticated clients can read unpublished content notifications

Umbraco CMS before 17.7.1 and 18.2.1 lets unauthenticated clients connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. An attacker can receive notifications that reveal content keys, including unpublished content, and the timing of editorial activity.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Umbraco CMS version in the project's package references, for example `Umbraco.Cms` in the .csproj file, and confirm whether it is below `17.7.1` or `18.2.1`.
- Look for the PreviewHub and BackofficeHub SignalR hubs being reachable from the internet, for example by requesting their negotiate endpoints without logging in.

## Fix

- Upgrade Umbraco CMS to `17.7.1` on the 17.x line or `18.2.1` on the 18.x line.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111624

## From the sources

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_