CVE-2022-24865

HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.

• CWE-200
• CWE-863

• https://github.com/humhub/humhub/commit/eb83de20aaecc559ab77a44a6179646a99607e33Patch, Third Party Advisory
• https://github.com/humhub/humhub/security/advisories/GHSA-2h35-f226-3f57Third Party Advisory
• https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76/Exploit, Patch, Third Party Advisory
• https://github.com/humhub/humhub/commit/eb83de20aaecc559ab77a44a6179646a99607e33Patch, Third Party Advisory
• https://github.com/humhub/humhub/security/advisories/GHSA-2h35-f226-3f57Third Party Advisory
• https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76/Exploit, Patch, Third Party Advisory

Published

Apr 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2486A vulnerability, which was classified as critical, was found…9.8
• CVE-2022-24860Databasir is a team-oriented relational database model docum…9.8
• CVE-2022-24861Databasir is a team-oriented relational database model docum…8.8
• CVE-2022-24862Databasir is a team-oriented relational database model docum…7.7
• CVE-2022-24863http-swagger is an open source wrapper to automatically gene…7.5
• CVE-2022-24864Origin Protocol is a blockchain based project. The Origin Pr…5.4
• CVE-2022-24866Discourse Assign is a plugin for assigning users to a topic …4.3
• CVE-2022-24867GLPI is a Free Asset and IT Management Software package, tha…7.5
• CVE-2022-24868GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-24869GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-2487A vulnerability has been found in WAVLINK WN535K2 and WN535K…9.8
• CVE-2022-24870Combodo iTop is a web based IT Service Management tool. In 3…5.4