Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-43847

HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-43847
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 12:01 UTC · Revision 1

Source evidence

CVE-2021-43847

core-osv · Original source

Published 20 Dec 2021, 22:15 UTC

HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.

osv:CVE-2021-43847
Complete source record
{
  "id": "746b4e198066a7af188c3a9ee349af5f5d221cf942ef953080eb485e6609e828",
  "url": "https://osv.dev/vulnerability/CVE-2021-43847",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-43847",
    "summary": "HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.",
    "evidence": "osv:CVE-2021-43847",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2021-43847",
      "aliases": [
        "CVE-2021-43847",
        "GHSA-f5hc-5wfr-7v74"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/humhub/humhub",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6cf5a397a6b80e87e7b38a045475803a9f37496b"
                },
                {
                  "introduced": "9441680ea372741a212741bfb70df4725bc8b04a"
                },
                {
                  "fixed": "77052eb86baa4e264e102c53367529b506b864be"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:humhub:humhub:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.9.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:humhub:humhub:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.10.0"
                      },
                      {
                        "fixed": "1.10.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "77052eb86baa4e264e102c53367529b506b864be"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.10.3"
                  },
                  {
                    "range": [
                      {
                        "fixed": "6cf5a397a6b80e87e7b38a045475803a9f37496b"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.9.3"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.10.2",
            "v1.10.1",
            "v1.10.0",
            "v1.9.2",
            "v1.9.1",
            "v1.9.0",
            "v1.9.0-beta.2",
            "v1.8.0-beta.2",
            "v1.8.0-beta.1",
            "v1.6.4",
            "v1.7.0",
            "v1.6.3",
            "v1.6.0",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0-beta.1",
            "v1.5.0-beta.1",
            "v1.4.0",
            "v1.4.0-beta.2",
            "v1.4.0-beta.1",
            "v1.3.7",
            "v1.3.6",
            "v1.3.5",
            "v1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.0",
            "v1.3.0-beta.1",
            "v1.2.1",
            "v1.2.0-beta.4",
            "v1.2.0-beta.2",
            "v1.0.0-beta.2",
            "v1.0.0-beta.1",
            "v0.20.1",
            "v0.20.0",
            "v0.20.0-beta.1",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.9.0",
            "v0.9.0-rc.2",
            "v0.9.0-rc.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43847.json"
          }
        }
      ],
      "modified": "2026-10-20T10:55:04.652981413Z",
      "provider": "osv",
      "references": [
        "https://github.com/humhub/humhub/releases/tag/v1.10.3",
        "https://github.com/humhub/humhub/releases/tag/v1.9.3",
        "https://github.com/humhub/humhub/pull/5473",
        "https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/",
        "https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-43847",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 386839,
  "published_at": "2021-12-20T22:15:08.003+00:00"
}