Humhub vulnerabilities
Published CVEs affecting Humhub products: 5 record(s), with severity, exploitation and fixes.
CVE-2026-47657
High · 7.1
CWE-862 Jul 21, 2026
HumHub Missing Authorization on Remove All Space Members Action
HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.
CVE-2026-29048
Medium · 6.1
CWE-79 Mar 6, 2026
HumHub: XSS in Button component
HumHub is an Open Source Enterprise Social Network. In version 1.18.0, a cross-site scripting vulnerability was identified in the Button component of version 1.18.0. Due to inconsistent output encoding at several points within the software, malicious scripts could be injected and executed in the context of the user's browser. This issue has been patched in version 1.18.1.
CVE-2026-29052
Medium · 6.1
CWE-79 Mar 5, 2026
HumHub Calendar Module: Stored XSS in Event Types
The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users viewing events created by an administrative account. This issue has been patched in version 1.8.11.
CVE-2025-65963
Medium · 5.4
CWE-284 Nov 25, 2025
CFiles Unauthorized Folder/ZIP Access in Public Spaces
Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.
CVE-2025-64442
Medium · 6.1
CWE-79 Nov 7, 2025
HumHub is vulnerable to XSS through its Meta Search component
HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.