Unauthorized Access in Umbraco CMS Affects Multiple Versions

CVE-2026-111624

What is CVE-2026-111624?

Umbraco CMS versions prior to 17.7.1 and 18.2.1 are susceptible to a missing authorization vulnerability. This flaw enables unauthenticated users to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. By exploiting this vulnerability, attackers can successfully complete the SignalR negotiate step. This access grants them notifications that potentially disclose sensitive content keys, which include unpublished content and timing of editorial activities. It's crucial for users of affected versions to update to the latest releases to mitigate this risk.

References