HumHub CVE-2026-93769

Exploitation requires an authenticated account holding the delegated, non-system-administrator 'Manage Users' permission (admin_manage_users) in HumHub 1.18.5 - this is a privileged management role, not an ordinary member, so it is an insider/compromised-privileged-account scenario rather than open unauthenticated access. The attacker injects the payload into a Profile Field Category title, and exploitation is only realized when a victim (another user or administrator) subsequently views the page that renders the unescaped fieldset legend/class, i.e. victim interaction is required. Limiting factors: high privilege prerequisite (PR:H), required victim user interaction (UI:P), and the fix is available in the vendor patch (PR #8499).

This is a real but modest, precondition-gated stored XSS. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:P) already signals the two key limiters: PR:H means the attacker must already hold a privileged delegated role (admin_manage_users / Manage Users), and UI:P plus AT:P mean a victim must view the poisoned Profile Field Category and specific attack circumstances must line up. The vector's VC:H/VI:H (mapped to the 7.2 score) is aggressive for a reflected/stored XSS - for a persistent script executing in another user's session I would rate confidentiality/integrity impact as Low, not High, since impact is bounded to browser-context actions rather than direct full compromise of the application data store. No EPSS score, no CISA KEV listing, and no public exploit code were provided (only a vendor advisory from Fluid Attacks), so there is no signal of active or automated exploitation. Net: this is a legitimate finding worth patching, but it is not an emergency - exploitation requires an already-trusted insider or a compromised user-management account, plus victim interaction, which places it well below internet-facing unauthenticated flaws in priority.

A user granted the delegated Manage Users permission (but not full system admin) edits a Profile Field Category and sets its title to a malicious payload such as <script>...</script>. When another user or a higher-privileged administrator later views the page rendering that category, the stored script executes in their browser session, enabling session/action abuse in their context. The Fluid Attacks advisory documents the issue; no weaponized public exploit code was provided in the input.