What’s Vulnerable › Vulnerabilities

CVE-2021-43847: Authorization Bypass in Space Invite in HumHub

• Severity: medium (CVSS 4.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-20 · updated 2026-06-17
• Weakness: CWE-285

Description

HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.

Affected products

• humhub: before 1.9.3; from 1.10.0 before 1.10.3 — fixed in 1.10.3, 1.9.3

How to fix

Upgrade to a fixed version: humhub 1.10.3, 1.9.3. Check the vendor advisory for mitigations.

References

• https://github.com/humhub/humhub/pull/5473
• https://github.com/humhub/humhub/releases/tag/v1.10.3
• https://github.com/humhub/humhub/releases/tag/v1.9.3
• https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74
• https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/
• https://github.com/humhub/humhub/pull/5473
• https://github.com/humhub/humhub/releases/tag/v1.10.3
• https://github.com/humhub/humhub/releases/tag/v1.9.3
• https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74
• https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/

Get alerted when CVE-2021-43847 or the next vulnerability affects your stack