CVE-2026-18756: HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering
HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated non-member into submitting the legitimate membership request form, and cause the server to return JavaScript containing attacker-controlled code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HumHub Community Editionto a version that resolves this vulnerability.Fixed in 1.18.4-pl1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Authenticated users who are not already members of a targeted space are exposed if they can be lured into submitting that space's legitimate membership request form with an attacker-controlled options query-string parameter.
What does an attacker need to exploit it?
The attacker needs to craft a request to the space/membership/request-membership-form endpoint containing attacker-controlled button configuration in the options query-string parameter, then induce an authenticated non-member to submit the form.
How can I determine whether an instance is affected?
The reported affected version is HumHub Community Edition 1.18.4. The vulnerable workflow returns JavaScript containing attacker-controlled code after a membership request form is submitted with malicious button configuration supplied through the options parameter.