Which versions of HumHub are affected by EUVD-2026-46349?

HumHub versions 1.13.0 through 1.18.2 contain broken access control allowing any authenticated user to delete all members from any Space without membership or role restrictions.. A patch is available.

How to fix or mitigate EUVD-2026-46349?

Within 24 hours, identify all HumHub instances running versions 1.13.0-1.18.2 and audit active authenticated user accounts with potential access. Within 7 days, test HumHub version 1.18.3 in staging and schedule production upgrade windows with minimal disruption to active Spaces. Within 30 days, deploy version 1.18.3 to all instances, verify Space membership integrity post-upgrade, and review audit logs for unauthorized member removal events dating back to deployment date of affected versions.

HumHub EUVD-2026-46349

Q: What is the CVSS score of EUVD-2026-46349?

EUVD-2026-46349 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-47657 HIGH

Missing Authorization (CWE-862)

2026-07-21 GitHub_M

Authentication Bypass Humhub

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Authenticated low-privilege user (PR:L) can remotely and trivially (AV:N/AC:L) destroy Space membership data - a high integrity impact (I:H) with no confidentiality and no metric-scored availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Jul 21, 2026 - 18:31 vuln.today

Analysis Generated

Jul 21, 2026 - 18:31 vuln.today

CVE Published

Jul 21, 2026 - 17:50 cve.org

HIGH 7.1

DescriptionCVE.org

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.

AnalysisAI

Broken access control in HumHub 1.13.0 through 1.18.2 lets any authenticated user delete every member of any Space, regardless of whether they belong to or hold any role in that Space. The flaw is a missing authorization rule on the Space member-management controller's 'remove-all' action (CWE-862), fixed in 1.18.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-to-trigger, authenticated-only nature makes it a realistic insider/low-privilege abuse risk.

Technical ContextAI

HumHub is a PHP (Yii2 framework) open-source enterprise social network organized around 'Spaces' (group workspaces) with per-Space membership and role-based permissions. The vulnerable code is protected/humhub/modules/space/modules/manage/controllers/MemberController.php, whose getAccessRules() enumerates the controller actions gated behind Space-admin authorization. As shown in the PR #8163 diff, the 'remove-all' action was omitted from that access-rule list while related actions ('remove', 'approve-applicant', etc.) were protected, so Yii's access filter never enforced the admin/permission check for bulk member removal. This is a textbook CWE-862 Missing Authorization: the endpoint existed and functioned but its authorization guard was never wired up, leaving it reachable by any logged-in account. The CPE cpe:2.3:a:humhub:humhub:*:*:*:*:*:*:*:* confirms the HumHub application itself is the affected component.

RemediationAI

Vendor-released patch: upgrade to HumHub 1.18.3 or later, which adds the missing 'remove-all' action to the MemberController access rules so bulk member removal is again gated behind Space administration permissions (see advisory GHSA-hj67-5q6h-j7c2 and PR https://github.com/humhub/humhub/pull/8163). The vendor states no known workaround is available, so upgrading is the only complete fix. As interim compensating controls until the upgrade can be applied, restrict who can obtain authenticated accounts (disable open/self-service registration and pause new-user approvals), since exploitation requires only a valid login; monitor application and audit logs for unexpected bulk member-removal events and maintain current backups of Space membership data so accidental or malicious mass removals can be restored - note these controls reduce exposure and aid recovery but do not close the vulnerable endpoint.