Stored Cross-Site Scripting Vulnerability in HumHub Community Edition
CVE-2026-115541

7.2HIGH

Key Information:

Vendor

Humhub

Status
Humhub Community Edition
Vendor
CVE Published:
3 November 2026

What is CVE-2026-115541?

HumHub Community Edition version 1.19.0 is vulnerable to a stored cross-site scripting (XSS) attack through the friendship confirmation dialog. This vulnerability allows an authenticated low-privileged user to inject malicious HTML into their profile name fields. When another authenticated user views this profile, the injected content is executed via jQuery when the friendship modal is displayed. As a result, attacker-controlled markup can compromise the security of other users by executing scripts in their session, thus threatening user data integrity and application trust.

Affected Version(s)

HumHub Community Edition Windows 0 < 1.18.7

HumHub Community Edition Windows 1.19.0 < 1.19.1

References

https://fluidattacks.com/advisories/toujours
third-party-advisory
https://github.com/humhub/humhub
product
https://github.com/humhub/humhub/security/advisories/GHSA...
vendor-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miguel GĂłmez
Fluid Attacks' AI SAST Scanner
.