CVE-2026-29052

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29052", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T17:50:11.244Z", "datePublished": "2026-03-05T05:48:10.557Z", "dateUpdated": "2026-03-05T15:30:11.121Z"}, "containers": {"cna": {"title": "HumHub Calendar Module: Stored XSS in Event Types", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/humhub/calendar/security/advisories/GHSA-gqj3-pmp2-mrx8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/humhub/calendar/security/advisories/GHSA-gqj3-pmp2-mrx8"}, {"name": "https://github.com/humhub/calendar/releases/tag/v1.8.11", "tags": ["x_refsource_MISC"], "url": "https://github.com/humhub/calendar/releases/tag/v1.8.11"}], "affected": [{"vendor": "humhub", "product": "calendar", "versions": [{"version": "< 1.8.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T05:48:10.557Z"}, "descriptions": [{"lang": "en", "value": "The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users viewing events created by an administrative account. This issue has been patched in version 1.8.11."}], "source": {"advisory": "GHSA-gqj3-pmp2-mrx8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:29:52.961012Z", "id": "CVE-2026-29052", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:30:11.121Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:29:52.961012Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:30:07.662Z"}}], "cna": {"title": "HumHub Calendar Module: Stored XSS in Event Types", "source": {"advisory": "GHSA-gqj3-pmp2-mrx8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "humhub", "product": "calendar", "versions": [{"status": "affected", "version": "< 1.8.11"}]}], "references": [{"url": "https://github.com/humhub/calendar/security/advisories/GHSA-gqj3-pmp2-mrx8", "name": "https://github.com/humhub/calendar/security/advisories/GHSA-gqj3-pmp2-mrx8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/humhub/calendar/releases/tag/v1.8.11", "name": "https://github.com/humhub/calendar/releases/tag/v1.8.11", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users viewing events created by an administrative account. This issue has been patched in version 1.8.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-05T05:48:10.557Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29052", "state": "PUBLISHED", "dateUpdated": "2026-03-05T15:30:11.121Z", "dateReserved": "2026-03-03T17:50:11.244Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-05T05:48:10.557Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "calendar", "vendor": "humhub", "versions": [{"status": "affected", "version": "< 1.8.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:humhub:calendar:*:*:*:*:*:humhub:*:*", "matchCriteriaId": "CB1365DA-6A8E-453B-81C8-1C0A759C87B4", "versionEndExcluding": "1.8.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Calendar module for HumHub enables users to create one-time or recurring events, manage attendee invitations, and efficiently track all scheduled activities. Prior to version 1.8.11, a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module impacts users viewing events created by an administrative account. This issue has been patched in version 1.8.11."}, {"lang": "es", "value": "El m\u00f3dulo de Calendario para HumHub permite a los usuarios crear eventos \u00fanicos o recurrentes, gestionar invitaciones de asistentes y rastrear eficientemente todas las actividades programadas. Antes de la versi\u00f3n 1.8.11, una vulnerabilidad de cross-site scripting (XSS) almacenado en los Tipos de Evento del m\u00f3dulo de Calendario de HumHub impacta a los usuarios que ven eventos creados por una cuenta administrativa. Este problema ha sido parcheado en la versi\u00f3n 1.8.11."}], "id": "CVE-2026-29052", "lastModified": "2026-09-02T14:35:45.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29052", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T15:29:52.961012Z", "version": "2.0.3"}}]}, "published": "2026-03-05T06:16:50.260", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/humhub/calendar/releases/tag/v1.8.11"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/humhub/calendar/security/advisories/GHSA-gqj3-pmp2-mrx8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "calendar", "source": "cna", "vendor": "humhub"}, "product": "calendar", "vendor": "humhub"}], "analysis": {"en": {"generated_at": "2026-04-16T12:55:55.707817+00:00", "value": {"mitigation_remediation": ["Upgrade the HumHub Calendar module to version 1.8.11 or later.", "Verify that any existing event types with custom HTML or JavaScript have been sanitized or removed to eliminate potential stored scripts.", "Restrict the ability to create or edit event types to trusted administrators and consider disabling the feature until the patch is applied if no immediate upgrade path is available."], "summary": {"action": "Immediate Patch", "impact": "Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts the HumHub Calendar module (humhub:calendar) and is present in all releases earlier than version 1.8.11. Administrators running HumHub Calendar 1.8.10 or older are vulnerable; the issue was corrected in version 1.8.11.", "description_and_impact": "A stored cross-site scripting flaw exists in the event type feature of the HumHub Calendar module. The flaw allows an attacker with administrative privileges to embed malicious scripts that are saved in the database, and the scripts execute in the browsers of any user who views the event. This can lead to arbitrary JavaScript execution, enabling session hijacking, credential theft, or defacement within the victim's session. The attack only affects users who view events created by an administrative account; normal users browsing events are impacted after the admin injects the malicious content.", "risk_and_exploitability": "The CVSS score of 6.9 denotes medium severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to have administrative access to insert malicious content into event types, after which any authenticated user viewing the event will have the stored script executed in their browser."}}}}, "created": "2026-03-06T15:17:46.239250+00:00", "updated": "2026-04-16T13:00:11.085761+00:00", "vendors": ["humhub", "humhub$PRODUCT$calendar"]}