CVE-2026-18756
Received Received - Intake

Reflected XSS in HumHub Community Edition

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Fluid Attacks

Description
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated non-member into submitting the legitimate membership request form, and cause the server to return JavaScript containing attacker-controlled code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-18756
EUVD
EUVD-2026-62500

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
humhub community_edition 1.18.4
humhub community_edition 1.18.4-pl1
humhub community_edition 1.18.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in HumHub Community Edition 1.18.4. It allows an attacker to inject malicious JavaScript by manipulating the options query-string parameter in the space membership request workflow. When an authenticated non-member submits a legitimate membership request form, the server returns JavaScript containing the attacker's code.

Detection Guidance
  • Check HumHub version with: grep -r "version" /path/to/humhub/config/common.php or via Admin Dashboard > System > Information.
  • Inspect network traffic for requests to /space/membership/request-membership-form with query parameters containing 'options'.
  • Use browser developer tools to monitor responses for JavaScript injection in membership request forms.
  • Deploy a web application firewall (WAF) rule to detect and block suspicious query parameters like 'options' with script tags.
Impact Analysis

An attacker could execute arbitrary JavaScript in your HumHub session. This may allow them to read session data, perform privileged requests, or modify user or Space state. The attack requires user interaction but executes within an authenticated session.

Compliance Impact

This reflected XSS vulnerability could allow attackers to execute arbitrary JavaScript in authenticated users' sessions. This may lead to unauthorized access to sensitive data, session hijacking, or manipulation of user or Space state, which could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited in healthcare or EU-based deployments.

Mitigation Strategies
  • Upgrade HumHub to version 1.18.5 or later immediately to apply the security patch.
  • Sanitize user-supplied input in the membership request workflow, especially the 'options' query parameter.
  • Implement strict input validation to allow only predefined safe attributes like mode, visible, and class.
  • Encode all dynamic content in responses using functions like Json::htmlEncode() to prevent JavaScript execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18756. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart