CVE-2021-43847

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-285 CWE-862

Affected software

Vendor	Product	Versions
humhub	humhub	>= 1.10.0, < 1.10.3; < 1.9.3

References

https://github.com/humhub/humhub/pull/5473Patch, Third Party Advisory
https://github.com/humhub/humhub/releases/tag/v1.10.3Release Notes, Third Party Advisory
https://github.com/humhub/humhub/releases/tag/v1.9.3Release Notes, Third Party Advisory
https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74Exploit, Third Party Advisory
https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/humhub/humhub/pull/5473Patch, Third Party Advisory
https://github.com/humhub/humhub/releases/tag/v1.10.3Release Notes, Third Party Advisory
https://github.com/humhub/humhub/releases/tag/v1.9.3Release Notes, Third Party Advisory
https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74Exploit, Third Party Advisory
https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Dec 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-438485.9h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC CVE-2021-438495.5cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS.CVE-2021-43854.3The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is CVE-2021-438506.8Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via CVE-2021-438518.8Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple file CVE-2021-438528.8OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject pr CVE-2021-438535.4Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to Ja CVE-2021-438547.5NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Na CVE-2021-438555.4Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload m CVE-2021-438565.4Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uplo CVE-2021-438578.8Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue i CVE-2021-438588.8MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-cra