CVE-2021-43847 Authorization Bypass in Space Invite in HumHub

Medium 6.5 Published 20 Dec 2021 Updated 4 Aug 2024

Registered users can bypass authorization to join private Spaces, gaining unauthorized access to restricted content.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-43847?

CVE-2021-43847 is a medium-severity missing authorization vulnerability in humhub, published on 20 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.

Weakness: CWE-862, CWE-285

Which versions are affected by CVE-2021-43847?

It affects 1 product.

Products include Humhub Humhub.

How do I fix CVE-2021-43847?

No fix has been published for CVE-2021-43847 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-43847 being exploited?

There is no known exploitation of CVE-2021-43847 in the wild and no public exploit code.

Sources

Also known as GHSA-f5hc-5wfr-7v74.