Stored XSS Vulnerability in HumHub Product by HumHub Vendor
CVE-2026-93769

7.2HIGH

Key Information:

Vendor

Humhub

Status
Humhub
Vendor
CVE Published:
23 September 2026

What is CVE-2026-93769?

HumHub 1.18.5 contains a stored cross-site scripting vulnerability that permits users with specific permissions (Manage Users) to inject arbitrary HTML and JavaScript code into Profile Field Category titles. This flaw could lead to the execution of malicious scripts within the application, potentially compromising user data and overall security.

Affected Version(s)

Humhub Windows 1.18.5

References

https://fluidattacks.com/advisories/cali
third-party-advisory
https://github.com/humhub/humhub
product
https://github.com/humhub/humhub/pull/8499
patch

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miguel GĂłmez
Fluid Attacks' AI SAST Scanner
.