Reflected Cross-Site Scripting Vulnerability in HumHub Community Edition by HumHub
CVE-2026-18756

7.2HIGH

Key Information:

Vendor

Humhub

Status
Humhub
Vendor
CVE Published:
19 August 2026

What is CVE-2026-18756?

HumHub Community Edition 1.18.4 is susceptible to a reflected cross-site scripting issue in the Space membership request process. The vulnerability arises when an attacker can manipulate the options query-string parameter within the request for a membership form. By enticing an authenticated non-member user to submit a legitimate membership request, the attacker can execute their own JavaScript code, leading to potential unauthorized actions or data exposure. It is crucial for users to be aware of this issue and apply necessary patches to mitigate risks.

Affected Version(s)

HumHub Windows 1.18.4

References

https://fluidattacks.com/es/advisories/turizo
third-party-advisory
https://github.com/humhub/humhub
product
https://github.com/humhub/humhub/pull/8381
patch

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miguel Gomez
Fluid Attacks' AI SAST Scanner
.