HumHub Community Edition 1.18.4 contains a reflected cross‑site scripting flaw in the Space membership‑request workflow. An attacker can insert malicious code into the options query‑string parameter on the membership‑request form, which the server echoes back as part of the page response when an authenticated user, who is not yet a member, submits the form. This allows the attacker to execute arbitrary client‑side scripts in the victim’s browser.

The vulnerability affects HumHub Community Edition 1.18.4 on all supported operating systems, including Linux, macOS, and Windows, as specified in the CPE identifiers for that version.

The CVSS base score of 7.2 indicates high severity. The EPSS score indicates a very low exploitation probability (<1%). The flaw is reflected and therefore can be exploited repeatedly. An attacker only needs to create a malicious link that passes JavaScript code via the options query‑string parameter and convince an authenticated non‑member user to submit the membership request form. The vulnerability is not listed in the CISA KEV catalog, but the fact that the attack vector is a simple web request and the need for a non‑member user makes it a priority for remediation.