CVE-2026-93769 in HumHub
Summary
by MITRE • 09/23/2026
HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The identified security flaw resides within HumHub version 1.18.5 and is classified as a stored cross-site scripting vulnerability affecting the user management subsystem. This specific weakness allows an attacker with delegated administrative privileges, specifically those holding the admin_manage_users permission but lacking full system administrator rights, to inject malicious script payloads into Profile Field Category titles. The persistence of this attack vector distinguishes it from reflected XSS variants, as the injected code is stored on the server-side database and subsequently served to other users upon request, thereby creating a long-term threat surface that does not require repeated exploitation attempts for each victim interaction.
From a technical perspective, the vulnerability stems from insufficient input validation and output encoding mechanisms within the module responsible for managing profile field categories. When an authenticated user with the specified permission level submits data for a Profile Field Category title, the application fails to properly sanitize special characters or encode HTML entities before storing the value in the database. Consequently, when this tainted data is retrieved and rendered by web browsers viewing the affected category details, the browser interprets the embedded JavaScript as executable code rather than static text content. This failure adheres closely to CWE-79, which defines Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). The specific context here involves stored data being rendered without adequate sanitization in a dynamic web application environment.
The operational impact of this vulnerability is significant due to the privilege level required for exploitation and the persistent nature of the attack. An attacker possessing the admin_manage_users permission can target any user or group that views the compromised Profile Field Category page. Upon loading, the malicious script executes within the security context of the victim's session cookie domain. This enables a range of adverse outcomes including session hijacking through theft of authentication tokens, credential harvesting via phishing forms injected into the legitimate interface, keylogging to capture sensitive input data, and potentially performing actions on behalf of the victim if they possess higher privileges than the attacker. Because the payload is stored server-side, every subsequent visitor or administrator viewing that specific category becomes a potential target without further interaction from the initial attacker.
This vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers as part of client-side code injection attacks. The attack chain typically involves reconnaissance to identify accessible profile categories, followed by exploitation using a crafted payload that bypasses existing filters, and finally persistence through storage in the database ensuring continued impact until remediation occurs. The presence of this flaw indicates gaps in the application's security design regarding role-based access control validation combined with robust input handling practices.
Mitigation strategies should focus on both immediate patching and long-term architectural improvements. Administrators must upgrade HumHub to a version where this specific input sanitization issue has been resolved by the vendor, ensuring that all profile field category titles are properly encoded before database insertion and rendering in HTML contexts. In addition to software updates, implementing strict Content Security Policy headers can help mitigate the impact of any remaining XSS vectors by restricting script execution sources. Furthermore, developers should adopt a defense-in-depth approach by enforcing server-side validation for all user-supplied data regardless of the caller's privilege level, ensuring that even delegated administrative functions adhere to the same rigorous security standards as core system operations. Regular code audits focusing on output encoding and input sanitization across all modules are essential to prevent similar vulnerabilities from emerging in future releases.