CVE-2026-18430: HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason
HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the payload?
A Space administrator can supply the malicious deletion reason when deleting another user's comment and electing to notify that user. The original comment author is exposed when the stored notification content is rendered.
What conditions are required for exploitation?
The attacker needs Space administrator privileges, a comment created by another user, and the ability to send that user a deletion notification. The deletion reason must contain HTML or JavaScript.
Is a default installation affected?
The available information identifies HumHub 1.18.4 as affected, but does not state whether the vulnerable notification flow is enabled or reachable in the default configuration.