CVE-2026-111624
Low
Description
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
SeverityLow
CVSS3.7
Exploit probability24. percentile0.3%
Product
Umbraco-CMS
PublishedOct 16, 2026
First seenOct 16, 2026
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- umbraco Umbraco-CMS17.7.1, 18.2.1 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| umbraco Umbraco-CMS | 17.0.0 ≤ v < 17.7.1, 18.0.0 ≤ v < 18.2.1 | 17.7.1, 18.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.