CVE-2026-18430
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
HumHub 1.18.4 contains a stored cross-site scripting (XSS) vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.
Risk Assessment
The risk includes execution of malicious scripts in the victim's browser, potentially leading to session theft, account takeover, and data confidentiality breach.
Recommendation
It is recommended to upgrade HumHub to a version that includes a fix for the XSS vulnerability and to validate and sanitize input data.
Other vulnerabilities in HumHub
See all- CVE-2026-93769High
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title.
- CVE-2026-18756High
HumHub Community Edition 1.18.4 contains a reflected XSS vulnerability in the space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of the request-membership-form, lure an authenticated non-member into submitting the legitimate form, and cause the server to return JavaScript containing attacker-controlled code.
- CVE-2026-18526High
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.
- CVE-2026-47657High
Vulnerability in HumHub (enterprise social network) allows any authenticated user to remove all members from any Space, regardless of their role. Missing access control in the member management controller.
Original NVD description (English source)
HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS