CVE-2026-93769: HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (adminmanageusers) to inject persistent HTML/JavaScript into a Profile Field Category title.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the delegated Manage Users permission (admin_manage_users) can exploit it. System administrator privileges are not required to inject the stored payload.
What access is needed for the impact to occur?
The attacker needs permission to manage users and must be able to set a Profile Field Category title. The injected HTML or JavaScript is persistent and can be used to target a system administrator.
Are ordinary users without administrative permissions affected as attackers?
The available information identifies the delegated admin_manage_users permission as the required capability. It does not indicate that users without this permission can inject the payload.
What should be prioritized if an update cannot be applied immediately?
Restrict the admin_manage_users permission to trusted accounts and review Profile Field Category titles for unexpected HTML or JavaScript. Because the payload is stored, remove suspicious titles and review delegated user-management accounts.