HumHub friendship dialog stored XSS flaw

A trick hidden in member names can run on other members' screens.

Summary

The HumHub friendship confirmation dialog does not safely handle member display names. A low-privileged logged-in member can store HTML in their name that runs in other members' browsers.

Affected when

Friendship system enabled
Display name built from first and last name

What to do

Update to HumHub 1.19.1 or 1.18.7 or later. Until then, disable the friendship system or set the display name format to username, and review existing names for HTML markup.

Update to at least the version for your product:

HumHub 1.18 1.18.7 or later
HumHub 1.19 1.19.1 or later

Can't update yet?

Add this line to the config file:

Disable "Enable user friendship system" under Administration > Settings > General

A wrong setting can stop the service or lock you out. Check the source links below first.

Products and platforms

HumHub Community Edition

CVE IDs

CVE-2026-115541 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: fluidattacks.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 21:59 UTC

First seen 2026-11-09 15:20 UTC