CVE-2026-18756
HighCVSS 7.2Summary
HumHub Community Edition 1.18.4 contains a reflected XSS vulnerability in the space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of the request-membership-form, lure an authenticated non-member into submitting the legitimate form, and cause the server to return JavaScript containing attacker-controlled code.
Risk Assessment
The risk involves potential execution of malicious scripts in the victim's browser, which could lead to session theft, account takeover, or other attacks in the context of the logged-in user.
Recommendation
It is recommended to update HumHub to the latest version that fixes this vulnerability and to validate and sanitize input in query parameters.
Original NVD description (English source)
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated non-member into submitting the legitimate membership request form, and cause the server to return JavaScript containing attacker-controlled code.