Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M

CVE-2026-47657HumHub Missing Authorization on Remove All Space Members Action

High 7.1

In plain English

A high-severity missing authorization in humhub from humhub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 69.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.

Affected products (as reported)

Vendor	Product	Versions
humhub	humhub	>= 1.13.0, < 1.18.3

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/humhub/humhub/security/advisories/GHSA-hj67-5q6h-j7c2 x_refsource_CONFIRM
https://github.com/humhub/humhub/pull/8163 x_refsource_MISC