CVE-2026-115541: HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation

Published Nov 3, 2026

Updated

HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HumHub Community Edition to a version that resolves this vulnerability.
Fixed in 1.19.2
Upgrade
Upgrade HumHub Community Edition to a version that resolves this vulnerability.
Fixed in 1.18.7

Event History

Nov 3, 2026

CVE Published

via MITRE·09:59 PM

Data Sourced

via MITRE·09:59 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attacker must be an authenticated, low-privileged HumHub member. No administrative privileges are indicated.

What must a victim do for the payload to execute?

Another authenticated user must open the attacker’s profile and click Friends. The stored display name is then inserted into the friendship-confirmation modal.

What environment is confirmed affected?

The affected product identified in the available data is HumHub Community Edition 1.19.0. The data does not establish whether other editions or versions are affected.

What can successful exploitation affect?

Attacker-controlled markup executes in the victim’s HumHub origin. The supplied severity data rates confidentiality and integrity impact as high, while availability impact is rated none.

CVE-2026-115541: HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need?

What must a victim do for the payload to execute?

What environment is confirmed affected?

What can successful exploitation affect?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What must a victim do for the payload to execute?

What environment is confirmed affected?

What can successful exploitation affect?