Missing authorization in HumHub Space member management (CVE-2026-47657)

A missing authorization check in HumHub's Space member management controller allows any authenticated user to trigger the removal of all members from any Space, without regard to the user's own role or membership in that Space. This vulnerability enables unauthorized mass removal of Space members by any logged-in user, potentially disrupting communities and causing loss of access across the platform. Affected versions: - 1.13.0 - 1.18.2 We recommend updating to: 1.18.3. CVSS 7.1 · our assessment: this_week Reference: https://github.com/humhub/humhub/security/advisories/GHSA-hj67-5q6h-j7c2 Details: https://vuln.today/cve/CVE-2026-47657