HumHub CVE-2026-18756

The victim must be an authenticated HumHub user who is not already a member of the targeted Space - unauthenticated users cannot trigger the vulnerable code path. The attacker must hold at least a low-privileged registered account on the same HumHub instance in order to know valid Space identifiers and craft a meaningful lure URL (as indicated by PR:L in the CVSS 4.0 vector). Active user interaction is required: the victim must click the crafted link and then submit the membership request form (UI:A in CVSS 4.0). No special server-side configuration is required - the vulnerability exists in the default membership request workflow. Exploitation is limited to a single HumHub instance (no cross-instance impact), and the attacker cannot exploit this purely server-side without victim interaction.

The CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:P/PR:L/UI:A) reflects meaningful exploitation friction: the attack requires both a low-privileged attacker account and active victim interaction (submitting a crafted form), and AT:P indicates that a specific target condition - the victim being an authenticated non-member - must be present. The VC:H/VI:H impact ratings are plausible because successful XSS in an authenticated session can yield full account takeover via session token theft or CSRF-equivalent actions. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, so real-world exploitation has not been confirmed. EPSS data was not provided in the input. Even a mid-sized community platform deployment - the kind a municipal IT team in legnica might run for internal collaboration - should treat this as a meaningful risk given that social-engineering lures (phishing links to the membership form) are low-cost for an attacker. The overall priority is moderate: the attack chain requires social engineering of an authenticated user and low attacker privileges, reducing opportunistic mass exploitation risk, but the consequence of a successful attempt is high because it operates on authenticated sessions.

An attacker with a registered HumHub account crafts a URL pointing to a target Space's membership request form, embedding a malicious JavaScript payload in the options query-string parameter. The attacker then sends this URL to an authenticated non-member of that Space via a phishing message or social channel. When the victim clicks the link and submits the displayed membership request form, the server processes the crafted options and returns a response containing the attacker's JavaScript, which executes in the victim's browser and can exfiltrate session tokens or perform actions on the victim's behalf. No public proof-of-concept code has been identified at time of analysis.