CVE-2026-18756CWE-79cross-site-scripting

CVE-2026-18756

published August 19, 2026

CVSS
7.2
EPSS
0%
Percentile
39.5
In the wild
Unconfirmed
What it is

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated non-member into submitting the legitimate membership request form, and cause the server to return JavaScript containing attacker-controlled code.

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
7.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
EPSS
0.00467 · 39.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-19T19:16Z
References (3)
https://fluidattacks.com/es/advisories/turizo · [email protected]https://github.com/humhub/humhub · [email protected]https://github.com/humhub/humhub/pull/8381 · [email protected]
EPSS history
Timeline
  • 19 AUG 14:46Z
    HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering
    cvelistv5