High · 7.2 CVE-2026-93769 EUVD-2026-85361

HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by Fluid Attacks

Vendor: HumHub GmbH & Co. KG Product: humhub

Description

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title.

Affected products

Vendor	Product	Affected	Fixed
Humhub	Humhub	1.18.5	—

References

https://fluidattacks.com/advisories/cali third-party-advisory
https://github.com/humhub/humhub product
https://github.com/humhub/humhub/pull/8499 patch