{"id":"CVE-2026-115541","kind":"vulnerability","aliases":["CVE-2026-115541"],"related":[],"title":"HumHub: stored XSS in friendship dialog via first/last name, fixed in 1.18.7 and 1.19.1","description":"HumHub Community Edition 1.19.0 contains a stored cross-site scripting vulnerability in the friendship confirmation dialog. An authenticated low-privileged member can save HTML in their first and last name. When another authenticated user clicks Friends for that profile, HumHub places the decoded display name into a modal through jQuery html(), causing attacker-controlled markup to execute in the victim's HumHub origin.","summary":"HumHub Community Edition 1.19.0 lets a logged-in member save HTML in their first and last name. When another logged-in user clicks Friends on that profile, the name is inserted as markup into the confirmation dialog, so the script runs in the victim's HumHub session.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"humhub","fixed":["1.18.7","1.19.1"],"affected":"< 1.18.7, >= 1.19.0, < 1.19.1","ecosystem":"packagist"}],"ecosystems":[],"tags":["humhub","package","php","self-hosted"],"not_affected_if":["different-version","friendships-disabled","no-public-registration","patched-version","username-display-name"],"how_to_check":"- Check the HumHub version (php protected/yii humhub/about or the admin About page). Exposed if below 1.18.7, or exactly 1.19.0.\n- Check Administration > Settings > General: 'Enable user friendship system' on, and Administration > Settings > Appearance: display name format using first and last name. If friendships are off or the format is username, the flaw is not reachable.\n- Review existing first and last names for HTML markup such as