CVE-2026-93769 — HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator accou…

CVE-2026-93769

HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover PUBLISHED

Description (CNA)

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title.

Affected (CNA)

Vendor / product	Versions
Humhub / Humhub	affected 1.18.5

CWE

CWE-79

References

https://fluidattacks.com/advisories/cali
https://github.com/humhub/humhub
https://github.com/humhub/humhub/pull/8499

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.