A stored cross‑site scripting flaw exists in the friendship confirmation dialog of HumHub Community Edition. An authenticated member with low privileges can inject HTML and script into their first and last name. When a different authenticated user opens that member’s friendship request, the injected markup is rendered in a modal via jQuery’s html() method, executing attacker‑controlled script within the HumHub origin. The impact is that the victim’s browser can run arbitrary code, enabling session hijacking, credential theft, or other malicious actions within the scope of the site’s authentication state.

Affected product: HumHub Community Edition. Vulnerable releases are 1.19.0 and all 1.18 maintenance releases earlier than 1.18.7. The vendor’s fix is delivered in 1.19.1 (not separately released) and 1.18.7, and subsequent releases 1.19.2 and later, or 1.18.7 and later, fully address the issue. Based on the CNA information, users should upgrade to 1.19.2 or newer, or to 1.18.7 or newer.

The vulnerability carries a CVSS score of 7.2, indicating a high severity. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. Attackers must be authenticated with a low‑privilege account and rely on a second authenticated user to trigger the modal. This restricts the attack surface to internal users, but still poses a significant risk for sites with many active users.