CVE-2026-111624 (GCVE-0-2026-111624)
Vulnerability from cvelistv5
Published
2026-10-16 17:39
Modified
2026-10-21 20:41
Severity ?
6.3 (Medium) - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-306 - Missing Authentication for Critical Function
Summary
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| umbraco | Umbraco-CMS |
Version: 17.0.0 ≤ Version: 18.0.0 ≤ |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T20:41:15.626898Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:41:26.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/umbraco/Umbraco-CMS",
"product": "Umbraco-CMS",
"repo": "https://github.com/umbraco/Umbraco-CMS",
"vendor": "umbraco",
"versions": [
{
"lessThan": "17.7.1",
"status": "affected",
"version": "17.0.0",
"versionType": "semver"
},
{
"lessThan": "18.2.1",
"status": "affected",
"version": "18.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.7.1",
"versionStartIncluding": "17.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "18.2.1",
"versionStartIncluding": "18.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lichoin"
}
],
"datePublic": "2026-10-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:00.093Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4c5q-6c64-96j7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHub.cs#L9-L11"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHubUpdater.cs#L58"
},
{
"tags": [
"patch"
],
"url": "https://github.com/umbraco/Umbraco-CMS/commit/b4f6cfc9d0955f9d8443e68353db4a692e91bd94"
},
{
"tags": [
"patch"
],
"url": "https://github.com/umbraco/Umbraco-CMS/commit/243e082479c777d0f585bbd2f8db571607767b22"
},
{
"name": "Umbraco-CMS release-18.2.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.2.1"
},
{
"name": "Umbraco-CMS release-17.7.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.7.1"
},
{
"name": "VulnCheck Advisory: Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.1-and-18.2.1-missing-authorization-on-signalr-hubs"
}
],
"title": "Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111624",
"datePublished": "2026-10-16T17:39:00.093Z",
"dateReserved": "2026-10-16T14:31:11.287Z",
"dateUpdated": "2026-10-21T20:41:26.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-111624\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-21T20:41:15.626898Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-21T20:41:22.431Z\"}}], \"cna\": {\"title\": \"Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"lichoin\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\"}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"repo\": \"https://github.com/umbraco/Umbraco-CMS\", \"vendor\": \"umbraco\", \"product\": \"Umbraco-CMS\", \"versions\": [{\"status\": \"affected\", \"version\": \"17.0.0\", \"lessThan\": \"17.7.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"18.0.0\", \"lessThan\": \"18.2.1\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:github/umbraco/Umbraco-CMS\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-10-06T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7\", \"name\": \"GitHub Security Advisory (GHSA-4c5q-6c64-96j7)\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHub.cs#L9-L11\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHubUpdater.cs#L58\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://github.com/umbraco/Umbraco-CMS/commit/b4f6cfc9d0955f9d8443e68353db4a692e91bd94\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/umbraco/Umbraco-CMS/commit/243e082479c777d0f585bbd2f8db571607767b22\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.2.1\", \"name\": \"Umbraco-CMS release-18.2.1 Release Notes\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.7.1\", \"name\": \"Umbraco-CMS release-17.7.1 Release Notes\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.1-and-18.2.1-missing-authorization-on-signalr-hubs\", \"name\": \"VulnCheck Advisory: Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"Missing Authentication for Critical Function\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"17.7.1\", \"versionStartIncluding\": \"17.0.0\"}, {\"criteria\": \"cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"18.2.1\", \"versionStartIncluding\": \"18.0.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-10-16T17:39:00.093Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-111624\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-21T20:41:26.462Z\", \"dateReserved\": \"2026-10-16T14:31:11.287Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-10-16T17:39:00.093Z\", \"assignerShortName\": \"VulnCheck\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…