Umbraco CMS CVE-2026-111624

No authentication is required (PR:N): the attacker only needs network reachability to the Umbraco backoffice SignalR endpoints (/umbraco/PreviewHub, /umbraco/backofficeHub) because those hub classes were missing the [Authorize(Policy = BackOfficeAccess)] attribute, leaving the negotiate and connection endpoints anonymously accessible. Exploitation is LIMITED by several factors: the backoffice SignalR endpoints must be network-exposed to the attacker (not firewalled/internal-only); disclosure is confined to data pushed to the hubs during active editorial/content-refresh activity, so the attacker must maintain a connection while editors are working (reflected as AT:P and AC:H); and the leak is read-only confidentiality of content keys (including unpublished content) and editorial timing - no credentials, content modification, or code execution are possible. Affected deployments are Umbraco CMS versions before 17.7.1 and before 18.2.1.

This is a medium-severity information-disclosure flaw (vendor CVSS 4.0 base 6.3). The provided CVSS vector (AV:N/PR:N/UI:N) confirms it is remotely reachable by unauthenticated clients with no user interaction, which raises its exposure, but AC:H and AT:P indicate real limiting conditions: successful disclosure depends on being connected to the hub while editorial/refresh activity is occurring, so exploitation is opportunistic/timing-dependent rather than deterministic. Impact is bounded - VC:L with VI:N/VA:N means low-confidentiality leakage (content keys, including unpublished content, and editorial activity timing) with no integrity or availability impact and no code execution. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was supplied, so there is no public exploit identified at time of analysis. The root cause is well understood and confirmed by the vendor source diff (SignalR hubs lacked the [Authorize(Policy = BackOfficeAccess)] attribute, so MapHub exposed anonymous negotiate endpoints). Net: a credible but moderate-priority issue - treat as a genuine patch-soon item for internet-exposed Umbraco backoffices because it is unauthenticated and network-facing, but it is not a critical/wormable RCE and the AC:H/AT:P conditions plus confidentiality-only impact keep real-world risk well below the attention a high-CVSS flaw would warrant.

An attacker who can reach an internet-exposed Umbraco backoffice sends an anonymous SignalR negotiate request to /umbraco/PreviewHub (or BackofficeHub), establishes a connection without any credentials, and passively receives the refresh notifications broadcast to the hub. While editors work, the attacker harvests disclosed content keys for unpublished content and infers editorial activity timing. No public exploit was supplied, but the attack only requires a standard SignalR client and no authentication (PR:N), though AC:H/AT:P mean the attacker must be connected during active editorial sessions to capture meaningful data.