CVE-2026-18526

HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.

Stored XSS may allow an attacker to inject malicious scripts that execute whenever other users view the page, potentially leading to data theft or account takeover.

It is recommended to update HumHub to a version that fixes this vulnerability and to implement proper sanitization of oEmbed content.