CVE-2017-20028 HumHub privileges management

What is CVE-2017-20028?

CVE-2017-20028 is a medium-severity vulnerability in unspecified HumHub, published on 9 Jun 2022.

Official description

A vulnerability was found in HumHub 0.20.1/1.0.0-beta.3. It has been classified as critical. This affects an unknown part. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. It is recommended to upgrade the affected component.

Weakness: CWE-269

Which versions are affected by CVE-2017-20028?

It affects 1 product.

Products include Humhub Humhub.

How do I fix CVE-2017-20028?

No fix has been published for CVE-2017-20028 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-20028 being exploited?

There is no known exploitation of CVE-2017-20028 in the wild and no public exploit code.

Other vulnerabilities in unspecified HumHub

• CVE-2014-9528 SQL injection in n/a High 7.5
• CVE-2025-64442 HumHub is vulnerable to XSS through its Meta Search component High 7.1
• CVE-2026-29048 HumHub: XSS in Button component Medium 6.9
• CVE-2024-52043 User enumeration in HubHub Medium 6.9
• CVE-2022-24865 Improper access control in humhub Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gvfm-vv3m-pgfr.