CVE-2026-47657highCWE-862

CVE-2026-47657: high-severity vulnerability in humhub

HumHub Missing Authorization on Remove All Space Members Action

Published

Follow this CVE+ Monitor humhub

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
humhub · humhub
Related CVEs — humhub

In the same product, most dangerous first.

CVE-2022-24865MEDIUMImproper access control in humhubEPSS 1.2%CVE-2021-43847MEDIUMAuthorization Bypass in Space Invite in HumHubEPSS 1.2%CVE-2022-31133MEDIUMCross site scripting in HumHubEPSS 0.7%CVE-2025-64442HIGHHumHub is vulnerable to XSS through its Meta Search componentEPSS 0.2%CVE-2026-29048MEDIUMHumHub: XSS in Button componentEPSS 0.2%