CVE-2026-111624: Umbraco CMS Auth Bypass Vulnerability

CVE-2026-111624 Overview

CVE-2026-111624 is a missing authorization vulnerability in Umbraco CMS that exposes two backoffice SignalR hubs, PreviewHub and BackofficeHub, to unauthenticated clients. The affected hubs lack an authorization policy, allowing remote clients to complete the SignalR negotiate handshake and subscribe to real-time notifications intended only for authenticated editors. Attackers receive content keys for published and unpublished items and can observe editorial activity timing. The flaw is tracked as CWE-306: Missing Authentication for a Critical Function and is fixed in Umbraco CMS 17.7.1 and 18.2.1.

Critical Impact
Unauthenticated network clients can enumerate backoffice content keys, including unpublished content, and infer editorial workflows through real-time SignalR notifications.

Affected Products

Umbraco CMS versions prior to 17.7.1
Umbraco CMS 18.x versions prior to 18.2.1
Deployments exposing the backoffice PreviewHub and BackofficeHub SignalR endpoints to untrusted networks

Discovery Timeline

2026-10-16 - CVE-2026-111624 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111624

Vulnerability Analysis

Umbraco CMS exposes two SignalR hubs from its management API: PreviewHub in src/Umbraco.Cms.Api.Management/Preview/PreviewHub.cs and BackofficeHub in src/Umbraco.Cms.Api.Management/Routing/BackofficeHub.cs. In versions before 17.7.1 and 18.2.1, neither hub class declared an [Authorize] attribute. The ASP.NET Core SignalR runtime therefore accepted anonymous connections to the hub endpoints and permitted clients to subscribe to broadcast messages.

The PreviewHubUpdater component pushes refreshed notifications containing content identifiers whenever editors save or preview content. Any connected client, including unauthenticated ones, received these messages. The leaked data includes content keys for unpublished items and timing metadata that reveals when editors are active.

Root Cause

The root cause is a missing authorization policy on backoffice SignalR hub classes. The project defines an AuthorizationPolicies.BackOfficeAccess policy for other management API routes, but it was not applied to the hub types. Because SignalR hubs inherit the application's default authentication state rather than enforcing backoffice access on their own, the absence of an explicit [Authorize] attribute left the hubs reachable without credentials.

Attack Vector

An attacker reaches the vulnerable endpoint over the network by issuing a standard SignalR negotiate request to the hub URL exposed by the backoffice. After negotiation, the client opens a WebSocket or long-polling connection and listens for refreshed notifications emitted by PreviewHubUpdater. No credentials, user interaction, or prior access are required. Exploitation discloses content keys and editorial activity but does not grant write access or modify data.

csharp

// Patch applied in Umbraco CMS 17.7.1 / 18.2.1 - PreviewHub.cs
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.SignalR;
+using Umbraco.Cms.Web.Common.Authorization;

 namespace Umbraco.Cms.Api.Management.Preview;

 /// <summary>
 /// Represents a SignalR hub used for managing content preview functionality within Umbraco CMS.
 /// Enables real-time communication for preview operations.
 /// </summary>
+[Authorize(Policy = AuthorizationPolicies.BackOfficeAccess)]
 public class PreviewHub : Hub<IPreviewHub>
 {
 }

Source: GitHub Commit 243e082. The same [Authorize(Policy = AuthorizationPolicies.BackOfficeAccess)] attribute was added to BackofficeHub in the same commit.

Detection Methods for CVE-2026-111624

Indicators of Compromise

Unauthenticated HTTP POST requests to SignalR negotiate endpoints such as /umbraco/management/api/.../previewHub/negotiate or /backofficeHub/negotiate from external IP ranges.
Long-lived WebSocket connections to backoffice hub paths originating from clients that never issued a login request.
Server logs showing SignalR connection IDs without an associated authenticated backoffice user principal.

Detection Strategies

Enable ASP.NET Core request logging on the Umbraco management API and alert on any 2xx response to hub endpoints when the request lacks an authenticated session cookie or bearer token.
Review reverse proxy or web application firewall logs for requests to paths containing previewHub or backofficeHub from source IPs outside the administrative network.
Correlate SignalR hub connection events with backoffice authentication events to identify sessions that never completed login.

Monitoring Recommendations

Monitor outbound traffic volume on hub endpoints for sustained connections from unexpected clients.
Track the Umbraco CMS version deployed across environments and flag any instance running a release older than 17.7.1 or 18.2.1.
Alert on new source IPs establishing SignalR connections to management API routes.

How to Mitigate CVE-2026-111624

Immediate Actions Required

Upgrade Umbraco CMS to version 17.7.1, 18.2.1, or later as published in the GitHub Security Advisory GHSA-4c5q-6c64-96j7.
Restrict network access to the /umbraco management API paths so only trusted administrative networks can reach the SignalR hubs.
Audit application logs for prior unauthenticated connections to PreviewHub and BackofficeHub and treat disclosed content keys as sensitive metadata.

Patch Information

Umbraco published fixes in Release 17.7.1 and Release 18.2.1. The code changes apply the [Authorize(Policy = AuthorizationPolicies.BackOfficeAccess)] attribute to both hub classes, as shown in commits 243e082 and b4f6cfc. Additional background is available in the VulnCheck advisory for Umbraco CMS.

Workarounds

Block external access to backoffice SignalR hub endpoints at the reverse proxy or web application firewall until the patch can be applied.
Restrict the /umbraco/management/api path to administrative source IPs through firewall rules or VPN-only access.
Where feasible, disable the preview feature in production environments that do not require real-time preview collaboration.

bash

# Example NGINX configuration to restrict backoffice hub endpoints
location ~* /umbraco/management/api/.*(previewHub|backofficeHub) {
    allow 10.0.0.0/8;      # internal admin network
    deny all;
    proxy_pass http://umbraco_backend;
}