CVE-2026-111624: Umbraco-CMS 17.0.0 to before 17.7.1, 18.0.0 to before 18.2.1

Affected technology

Umbraco-CMS · 17.0.0 to before 17.7.1, 18.0.0 to before 18.2.1
umbraco

Description’s affected range: before 17.7.1 and 18.2.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality impact as low; integrity and availability impact as none.