The vulnerability is a missing authorization check (CWE-306) in the backoffice PreviewHub and BackofficeHub SignalR hubs of Umbraco CMS. Successful exploitation allows unauthenticated clients to perform the SignalR negotiate step and then continuously receive refreshed notifications. These notifications reveal content keys for unpublished content and expose editorial activity timing, effectively disclosing sensitive information that should remain confidential.

Affected systems are installations of Umbraco CMS versions prior to 17.7.1 and 18.2.1. The issue is present in all releases of the Umbraco CMS product that include the vulnerable backoffice SignalR hub components and is fixed in the 17.7.1 and 18.2.1 releases.

The CVSS score of 6.3 indicates a medium severity impact. Although EPSS data is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation reports. The lack of an authorization guard means that as long as an attacker can reach the hub endpoints, they can trigger the notification flow and extract the disclosed data. The attack likely requires network connectivity to the backoffice endpoint, and if the application is publicly exposed, the risk is elevated. The vulnerability is exploitable without privilege escalation, providing direct information disclosure to unauthenticated network users.