PT-2026-116023

CVE-2026-111624

Published

2026-10-16

Updated

2026-10-21

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Umbraco CMS versions prior to 17.7.1 Umbraco CMS versions prior to 18.2.1

Description Missing authorization allows unauthenticated clients to connect to the backoffice 'PreviewHub' and 'BackofficeHub' SignalR hubs. By completing the SignalR negotiate step, attackers can receive refreshed notifications that disclose content keys, including unpublished content, and reveal the timing of editorial activity.

Recommendations Update to version 17.7.1 or later. Update to version 18.2.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Lichoin

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

Related identifiers