HumHub CVE-2026-115541

Exploitation requires an authenticated low-privileged account able to set its own first and last name, and is limited to installations where the friendship system is enabled AND the display name format is built from first and last name (per the GHSA). A separate authenticated victim must actively click the Friends button on the attacker's profile or People entry for the payload to fire - there is no self-triggering path. Limiting factors: required low-privilege authentication (PR:L), mandatory victim interaction (UI:A), and dependence on the above non-universal display-name/friendship configuration. Vendor-stated mitigations are to disable 'Enable user friendship system' under Administration > Settings > General, set the display name format to the username under Administration > Settings > Appearance, review existing names for HTML markup, and upgrade to 1.18.7 or 1.19.1 (or later), which the vendor presents as the complete fix.

Severity signals cluster in the high-but-conditional band rather than the drop-everything band. The supplied CVSS 4.0 vector (7.2, High) encodes network reach (AV:N) and low attack complexity (AC:L) but is tempered by three dampeners: PR:L (the attacker must hold a registered low-privileged account), UI:A (a second user must actively click the Friends button on the attacker's profile or People entry), and AT:P (an attack requirement - exploitation depends on that victim interaction occurring). No EPSS score was supplied, so statistical exploitation likelihood cannot be quantified. The CVE is NOT in CISA KEV and no SSVC exploitation value was provided; the only prioritization signal is the vuln.today Decision label 'this_week', which is consistent with a High-severity stored XSS that is not under active exploitation. The genuine aggravating factor is the victim set: because any user - including a System Administrator - who clicks Friends on the malicious profile executes the payload in their own HumHub origin, successful exploitation against an admin can escalate to full application compromise, which is why the vendor urges immediate upgrade. Net assessment: a real, patch-this-week priority for exposed HumHub instances, but not an emergency - the authentication requirement, mandatory victim interaction, and configuration dependency keep it below mass-exploitation risk.

A low-privileged member registers (or edits their profile) and stores an HTML/script payload inside their first and last name fields. When another authenticated user - potentially a System Administrator - opens that profile or People entry and clicks the Friends button, HumHub inserts the decoded display name into the confirmation modal via jQuery html(), executing the attacker's markup in the victim's session. No public exploit code was identified at time of analysis, though Fluid Attacks published an advisory describing the issue.