CVE-2026-18756: HumHub Community Edition XSS Vulnerability

CVE-2026-18756 Overview

CVE-2026-18756 is a reflected cross-site scripting (XSS) vulnerability in HumHub Community Edition 1.18.4. The flaw resides in the Space membership-request workflow at space/membership/request-membership-form. Attackers can inject attacker-controlled button configuration through the options query-string parameter. When an authenticated non-member submits the legitimate membership request form, the server returns JavaScript containing the attacker-controlled code, executing it in the victim's browser session. The weakness maps to CWE-79, improper neutralization of input during web page generation.

Critical Impact
Successful exploitation enables execution of arbitrary JavaScript in the context of an authenticated HumHub user, exposing session data, account actions, and social-network content to compromise.

Affected Products

HumHub Community Edition 1.18.4
HumHub Space membership-request workflow (space/membership/request-membership-form)
Deployments exposing the options query-string parameter to untrusted input

Discovery Timeline

2026-08-19 - CVE-2026-18756 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-18756

Vulnerability Analysis

The vulnerability is a reflected XSS issue in HumHub's Space membership-request flow. The endpoint space/membership/request-membership-form accepts a client-controlled options query parameter. This parameter is intended to configure UI button behavior for the membership request form. The server does not adequately sanitize the value before reflecting it into the JavaScript response used to render the form.

When an authenticated non-member submits the form, the server returns JavaScript that embeds attacker-controlled content. That code executes in the victim's authenticated session with the privileges of the logged-in user. The vulnerability requires user interaction, since the victim must click a lure and submit the request form, but no elevated privileges are required beyond a valid user account.

Exploitation impacts confidentiality and integrity in the victim's browser context. Attackers can steal session tokens, perform actions as the victim within the HumHub instance, and pivot to further account compromise. Because HumHub is a collaboration and social networking platform, exploited accounts often provide access to private spaces and messages.

Root Cause

The root cause is insufficient output encoding of the options parameter when the server generates the JavaScript response for the membership request form. User-supplied button configuration is incorporated into script output without neutralizing characters that break out of the intended data context.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL to space/membership/request-membership-form containing a malicious options payload. The attacker lures an authenticated non-member of the target Space to visit the URL and submit the legitimate-looking membership request form. Details of the request format and payload structure are documented in the Fluid Attacks Security Advisory and the upstream fix in GitHub Pull Request #8381.

Detection Methods for CVE-2026-18756

Indicators of Compromise

Requests to space/membership/request-membership-form containing suspicious characters in the options query-string parameter, such as <, >, quotes, or script tokens
Referer headers pointing to attacker-controlled domains preceding membership-request submissions
Anomalous outbound requests from authenticated user sessions immediately after visiting Space membership pages

Detection Strategies

Inspect web server and application logs for options parameter values that deviate from expected button-configuration JSON structure
Deploy a web application firewall rule that flags XSS payload patterns in query strings targeting HumHub membership endpoints
Correlate authenticated session activity with membership-request submissions originating from external referers

Monitoring Recommendations

Enable verbose HTTP request logging for the HumHub space/membership/* route family
Monitor for spikes in membership requests submitted by users who are not typical joiners of the target Space
Alert on browser-side Content Security Policy (CSP) violations reported by users interacting with HumHub

How to Mitigate CVE-2026-18756

Immediate Actions Required

Upgrade HumHub Community Edition to a version that includes the fix from GitHub Pull Request #8381
Restrict access to HumHub instances behind authenticated VPN or SSO gateways where feasible to limit exposure to untrusted referers
Advise users to avoid clicking Space membership links from untrusted sources until the patch is deployed

Patch Information

The HumHub project addressed the issue in GitHub Pull Request #8381 on the HumHub repository. Administrators running HumHub Community Edition 1.18.4 should upgrade to the fixed release referenced in that pull request. Additional context is available in the Fluid Attacks Security Advisory.

Workarounds

Deploy a Content Security Policy that disallows inline script execution to reduce the impact of reflected script injection
Add a WAF rule to block or sanitize requests to space/membership/request-membership-form whose options parameter contains HTML or script metacharacters
Temporarily disable the public Space membership-request feature on internet-exposed HumHub instances until patched

bash

# Example WAF rule (ModSecurity) to block script payloads in the options parameter
SecRule REQUEST_URI "@contains /space/membership/request-membership-form" \
  "chain,phase:2,deny,status:403,id:1026018756,msg:'HumHub CVE-2026-18756 XSS attempt'"
  SecRule ARGS:options "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"