HumHub vulnerabilities
We track 6 vulnerabilities in HumHub products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest HumHub vulnerabilities
- 7.2 High severity
HumHub Community Edition: Improper Neutralization of Input During Web Page Generation
HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for th
- 7.2 High severity
Humhub: Improper Neutralization of Input During Web Page Generation
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category
- 7.2 High severity
HumHub: Improper Neutralization of Input During Web Page Generation
HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.
- 7.2 High severity
HumHub: Improper Neutralization of Input During Web Page Generation
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-m
- 7.4 High severity
HumHub: Improper Neutralization of Input During Web Page Generation
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.
- 7.1 High severity
humhub: Missing Authorization
HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of th