CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

EUVD-2026-62415

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526

HumHub CE 1.18.4 and 1.18.4-pl1 have a stored XSS flaw in the oEmbed confirmation rendering workflow; the fix is tracked in GitHub PR #8373 (https://github.com/humhub/humhub/pull/8373). No exploitation evidence is provided in the documents.

CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

CVE-2026-18430: Improper Neutralization of Input During Web Page Generation

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-18526: Improper Neutralization of Input During Web Page Generation

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...

PT-2026-78432

Name of the Vulnerable Software and Affected Versions HumHub Community Edition version 1.18.4 Description A reflected cross-site scripting issue exists in the Space membership-request workflow. An attacker can inject malicious button configuration into the options query-string parameter of the...

PT-2026-78489

Name of the Vulnerable Software and Affected Versions HumHub version 1.18.4 Description A stored cross-site scripting issue exists in the comment-deletion notification flow. A Space administrator can exploit this by deleting another user's comment and inserting HTML or JavaScript into the deletio...

CVE-2026-18756: Improper Neutralization of Input During Web Page Generation

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...

PT-2026-78374

Name of the Vulnerable Software and Affected Versions HumHub Community Edition versions 1.18.4 and 1.18.4-pl1 Description A stored Cross-Site Scripting XSS issue exists in the oEmbed confirmation rendering workflow. XSS is a flaw that allows an attacker to inject malicious scripts into content th...

CVE-2026-47657

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...

CVE-2026-47657 HumHub Missing Authorization on Remove All Space Members Action

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...

CVE-2026-47657

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...

EUVD-2026-46349

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...

CVE-2026-47657 HumHub Missing Authorization on Remove All Space Members Action

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...

CVE-2026-47657 HumHub Missing Authorization on Remove All Space Members Action

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...

CVE-2026-47657

HumHub CVE-2026-47657 affects HumHub versions 1.13.0–1.18.2. A missing authorization check in the Space member management controller lets any authenticated user remove all members from any Space, regardless of their role. The issue is fixed in version 1.18.3; upgrade to 1.18.3 or later. The CVSSv...

PT-2026-62002

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...

CVE-2026-47657: Missing Authorization

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that...