CVE-2026-47657
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in HumHub (enterprise social network) allows any authenticated user to remove all members from any Space, regardless of their role. Missing access control in the member management controller.
Risk Assessment
Risk of complete removal of members from spaces, disrupting collaboration and access to resources.
Recommendation
Upgrade HumHub to version 1.18.3.
Other vulnerabilities in HumHub
See all- CVE-2026-18430High
HumHub 1.18.4 contains a stored cross-site scripting (XSS) vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.
- CVE-2026-18756High
HumHub Community Edition 1.18.4 contains a reflected XSS vulnerability in the space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of the request-membership-form, lure an authenticated non-member into submitting the legitimate form, and cause the server to return JavaScript containing attacker-controlled code.
- CVE-2026-18526High
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.
Original NVD description (English source)
HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.