Auth bypass in Humhub

CVE-2026-47657

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Sp…

Vulnerability class: Broken Access Control

Affected products

  • Humhub — versions >= 1.13.0, < 1.18.3

Weakness classification (CWE)

References