Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111624 · Microsoft / collected KEV context

cve-program · CVE-2026-111624

• https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-4c5q-6c64-96j7
• https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHub.cs#L9-L11
• https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.0/src/Umbraco.Cms.Api.Management/Preview/PreviewHubUpdater.cs#L58
• https://github.com/umbraco/Umbraco-CMS/commit/b4f6cfc9d0955f9d8443e68353db4a692e91bd94
• https://github.com/umbraco/Umbraco-CMS/commit/243e082479c777d0f585bbd2f8db571607767b22
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-18.2.1
• https://github.com/umbraco/Umbraco-CMS/releases/tag/release-17.7.1
• https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.1-and-18.2.1-missing-authorization-on-signalr-hubs

No related operational record is retained in the current change model.