HumHub CVE-2026-47657

Requires an authenticated HumHub account (PR:L) but nothing more - the attacker does NOT need to be a member of, or hold any role in, the targeted Space, because the 'remove-all' action in the Space member-management controller lacked an authorization rule. The concrete prerequisite is simply reaching the Space manage MemberController 'remove-all' endpoint on any HumHub instance running 1.13.0-1.18.2. Limiting factors: a valid login is mandatory (fully anonymous exploitation is not possible), so exposure scales with how easily accounts can be obtained (open registration greatly increases risk); no user interaction and no special non-default configuration are needed, and the affected version range is bounded to 1.13.0 through 1.18.2 with 1.18.3+ not vulnerable.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N, score 7.1) is internally consistent with the description: network-reachable, low complexity, requires only a low-privileged authenticated account, no user interaction, and a high integrity impact (destruction of Space membership) with no confidentiality or direct availability metric. No EPSS score, POC, or SSVC decision data was supplied, and the CVE is not in CISA KEV, so there is no evidence of active exploitation or automated weaponization - this is a real but not emergency-tier issue. The main tension worth flagging: the vector rates availability as N (VA:N), yet mass-removing all members effectively renders a Space unusable, so real-world operational impact may be closer to an availability/denial effect than the vector implies. Because exploitation needs a valid account (PR:L), risk is highest in open-registration or large multi-tenant HumHub deployments where any user can obtain credentials; in tightly controlled internal instances the population of potential abusers is limited.

A regular authenticated HumHub user - potentially one who self-registered on an open instance - sends a request to the Space member-management 'remove-all' endpoint targeting a Space they neither administer nor belong to, and the missing authorization check lets the request succeed, wiping out that Space's entire membership. Because attack complexity is low and no user interaction is required, this can be repeated against many Spaces to disrupt collaboration across the platform. No public exploit code has been identified at time of analysis, though the fix commit reveals the exact vulnerable action.