CVE-2026-47657

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47657
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47657.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47657
Aliases
  • GHSA-hj67-5q6h-j7c2
Published
2026-07-21T17:50:08.427Z
Modified
2026-07-25T03:56:32.724838746Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
HumHub Missing Authorization on Remove All Space Members Action
Details

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47657.json"
}
References

Affected packages

Git / github.com/humhub/humhub

Affected ranges

Type
GIT
Repo
https://github.com/humhub/humhub
Events
Introduced
c3f4cbba3fffc02ab5dc567b7b1d47b485daf276
Fixed
a6a2710b84b9c851e5685520786ebfb809a8cb0d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.13.0"
        },
        {
            "fixed": "1.18.3"
        },
        {
            "fixed": "1.18.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v1.*
v1.13.0
v1.13.1
v1.13.2
v1.15.0-beta.1
v1.15.0-beta.2
v1.16.0-beta.1
v1.16.0-beta.2
v1.18.0
v1.18.0-beta.2
v1.18.0-beta.3
v1.18.0-beta.4
v1.18.0-beta.5
v1.18.0-beta.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47657.json"