CVE-2026-18756

This is a reflected XSS in HumHub's membership request workflow stemming from an `options` query parameter that accepts serialized configuration and reflects it directly into JavaScript contexts without encoding. The vulnerability scores 7.2 CVSS, but the real severity is worse than that number suggests — this endpoint is a trust boundary where community gatekeepers (admins, moderators) process join requests. Compromising their session gives access to private member communications, admin panels, content moderation tools, and potentially integration tokens. The social blast radius on a community platform far exceeds what the technical severity captures. The deeper problem isn't this specific bug — it's the architectural pattern that keeps reproducing across ecosystems. This exact vulnerability class has appeared in WordPress plugins, Laravel packages, React component libraries, and now HumHub. Every time, the same implementation: a query parameter carrying serialized data reflected into a JavaScript variable or DOM operation. The pattern persists because developers face a tooling gap: frameworks enforce HTML encoding by default and make it painful to output unescaped content, but JavaScript contexts get zero protection. A developer can assign a query parameter value to a JavaScript variable with complete silence from the framework — no warnings, no friction, no muscle memory built from constraint. For defenders, the audit implication is straightforward: search your codebase for query parameters that flow into inline JavaScript or DOM manipulation methods. If you find patterns like `options`, `config`, `data`, or `settings` in query strings being reflected into script blocks or `innerHTML` calls, you have this vulnerability. The remediation isn't just encoding — it's architectural. Configuration that affects client-side JavaScript should travel through POST bodies with CSRF protection, server-side session state, or `data-*` attributes, never through query parameters that get reflected verbatim. The `options` parameter in HumHub is a repeatable template that future developers will unconsciously copy; audit for its cousins elsewhere in the codebase.

Reviewed through automated stages and approved by a human before publication.