CVE-2026-115541

    Dashboard / Vulnerabilities / CVE-2026-115541

    CVE-2026-115541

    Published: 3 Nov 2026Last Modified: 8 Nov 2026

    Summary: HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation

    Details: HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.

    References: https://fluidattacks.com/advisories/toujours, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115541.json, https://github.com/humhub/humhub/releases/tag/v1.18.7, https://github.com/humhub/humhub/releases/tag/v1.19.3, https://github.com/humhub/humhub/security/advisories/GHSA-ph8x-wg86-qp2m, https://nvd.nist.gov/vuln/detail/CVE-2026-115541, https://github.com/humhub/humhub/pull/8624, https://github.com/humhub/humhub/pull/8625, https://github.com/humhub/humhub

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -013367b89fc634be59351d8fdb2169a4ab19945a

    Affected versions

    v1.19.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-115541 | CVE-DB