CVE-2026-93769: HumHub Stored XSS Vulnerability

CVE-2026-93769 Overview

CVE-2026-93769 is a stored cross-site scripting (XSS) vulnerability in HumHub 1.18.5. The flaw allows any user holding the delegated admin_manage_users permission to inject persistent HTML or JavaScript into a Profile Field Category title. The injected payload executes in the browser of any user who loads the affected profile administration view. This weakness is classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated delegated administrator can persistently inject JavaScript into a Profile Field Category title, executing arbitrary script in the context of other users, including full system administrators, enabling privilege escalation and account takeover.

Affected Products

HumHub 1.18.5
HumHub deployments granting the delegated admin_manage_users permission to non-system-administrator roles
Fixed via GitHub Pull Request #8499

Discovery Timeline

2026-09-23 - CVE-2026-93769 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93769

Vulnerability Analysis

HumHub allows administrators to organize user profile attributes into logical groups called Profile Field Categories. Each category has a translatable title that appears in the profile administration user interface. HumHub 1.18.5 fails to properly neutralize HTML control characters in the category title before rendering it in the browser.

A user granted the admin_manage_users permission can create or edit a Profile Field Category and supply a title containing HTML tags or script content. The payload is stored server-side and rendered without adequate output encoding. When any other user with access to the profile management view loads the page, the browser parses and executes the injected markup.

Because the payload runs in an authenticated session, an attacker can hijack the session of a full system administrator, perform actions on their behalf, or exfiltrate sensitive data accessible from the browser context.

Root Cause

The root cause is missing output encoding of a user-controlled string that is trusted because it is only editable by a privileged role. HumHub treats the delegated admin_manage_users permission as sufficient to write the category title but does not sanitize the value on render. This violates the principle that all user-supplied input must be neutralized regardless of the source's privilege level. See the Fluid Attacks Advisory: Cali for the full technical description.

Attack Vector

Exploitation requires an authenticated account with the delegated admin_manage_users permission. The attacker navigates to the Profile Field Category management interface and submits a title containing a JavaScript payload. The stored payload triggers automatically for any subsequent user, including higher-privileged system administrators, who views the affected page. The remediation is tracked in GitHub Pull Request #8499 in the HumHub repository.

No verified exploit code is available. See the vendor advisory referenced above for technical details.

Detection Methods for CVE-2026-93769

Indicators of Compromise

Profile Field Category records whose title column contains HTML tags such as <script>, <img, <svg, or event handler attributes like onerror= and onload=.
Web server access logs showing POST requests to HumHub profile field category administration endpoints from accounts holding only the delegated admin_manage_users permission.
Outbound HTTP requests from administrator browsers to unexpected external hosts shortly after loading the profile administration interface.

Detection Strategies

Query the HumHub database for stored category titles and match values against a regular expression that flags angle brackets, JavaScript URIs, and HTML event handlers.
Review the audit trail of Profile Field Category create and update operations and correlate with the acting user's assigned permissions.
Deploy Content Security Policy (CSP) report-only headers to surface inline script executions originating from administrative views.

Monitoring Recommendations

Alert on any modification to Profile Field Category titles performed by a non-system-administrator account.
Monitor administrative session behavior for anomalous actions such as new user creation or permission changes performed immediately after viewing profile management pages.
Ingest HumHub application and web server logs into a centralized analytics platform to enable historical review of category title changes.

How to Mitigate CVE-2026-93769

Immediate Actions Required

Upgrade HumHub to a version that includes the fix from Pull Request #8499.
Audit all Profile Field Category titles for existing HTML or JavaScript content and remove any malicious values.
Review the assignment of the admin_manage_users permission and revoke it from accounts that do not require it.

Patch Information

The HumHub maintainers addressed the vulnerability in Pull Request #8499. The patch applies proper output encoding to Profile Field Category titles so stored HTML is rendered as text rather than executed as markup. Administrators running HumHub 1.18.5 should apply the fix and confirm the affected views escape user-controlled titles.

Workarounds

Restrict the admin_manage_users permission to fully trusted system administrators until the patched version is deployed.
Enforce a strict Content Security Policy that disallows inline scripts across administrative interfaces to reduce the impact of stored payloads.
Manually sanitize existing Profile Field Category titles in the database and block angle brackets at the application input layer via a reverse proxy rule.

bash

# Query stored Profile Field Category titles for suspicious content
mysql -u humhub -p humhub -e \
  "SELECT id, title FROM profile_field_category \
   WHERE title REGEXP '<|javascript:|onerror=|onload=';"