Authorization Bypass in HumHub Social Network Affects Multiple Versions

CVE-2026-47657

What is CVE-2026-47657?

HumHub, an open-source enterprise social network, is affected by an authorization bypass vulnerability found in versions 1.13.0 through 1.18.2. This flaw resides in the Space member management controller, where any authenticated user can remove all members from any Space, irrespective of their designated role or membership status. This poses a significant security concern as it undermines the integrity of member management. Users are strongly encouraged to update to version 1.18.3 or later, where the vulnerability has been addressed, as there are no known workarounds.

References