CVE-2026-47657

UNKNOWN

Published 2026-07-21 · Updated 2026-07-21 · Source security-advisories@github.com

Description

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.

CWE-862

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-64798
Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
2026-07-22 · score —
CVE-2026-64797
IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.
2026-07-22 · score —
CVE-2026-64796
Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.
2026-07-22 · score —
CVE-2026-64795
Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
2026-07-22 · score —
CVE-2026-64794
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.
2026-07-22 · score —