CVE-2026-29052 Humhub CVE debrief

Who should care

Users of HumHub Calendar module, administrators of affected installations, and security teams responsible for vulnerability management should prioritize patching to version 1.8.11 or later. Review and update affected installations, and monitor for suspicious activity. Ensure that all users viewing events created by administrative accounts are aware of the potential risks and take necessary precautions. Compensating controls, such as web application firewalls, may be considered for exposed systems while remediation is scheduled and verified. Tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented are crucial steps in the remediation process. Additionally, verifying the integrity of event types and ensuring that they do not contain malicious scripts is essential. This may involve reviewing logs and monitoring for unusual activity. By taking these steps, organizations can minimize the risk of exploitation and protect their users from potential attacks. It is also essential to review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory management is crucial in identifying and prioritizing affected systems for remediation. Rollback change windows should be considered if immediate patching is not feasible. Source tracking and monitoring can help detect potential exploitation attempts. By prioritizing patching and taking these additional steps, organizations can effectively manage the risk associated with CVE-2026-29052 and protect their users from potential attacks. CVE-2026-29052 is rated MEDIUM with a CVSS score of 6.9. Users should prioritize patching to prevent Stored Cross-Site Scripting (XSS) attacks. Limited evidence is available; further review is recommended. The CVE record was published on 2026-03-05T06:16:50.260Z and has not been modified since then. The NVD entry is currently Analyzed. This information should be considered when assessing the risk and prioritizing remediation efforts. Security teams should review the official CVE Program record and NIST NVD detail page to

Technical summary

CVE-2026-29052 is a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module. The issue impacts users viewing events created by an administrative account and has been patched in version 1.8.11. This vulnerability allows an attacker to inject malicious scripts into the event types, potentially leading to unauthorized actions on behalf of the user. Users of the HumHub Calendar module should review and update affected installations to prevent exploitation.

Defensive priority

CVE-2026-29052 is rated MEDIUM with a CVSS score of 6.9. Users should prioritize patching to prevent Stored Cross-Site Scripting (XSS) attacks.

Recommended defensive actions

• Patch to version 1.8.11 or later
• Review and update affected installations
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-29052 issue is a Stored Cross-Site Scripting (XSS) vulnerability in the Event Types of the HumHub Calendar module. It impacts users viewing events created by an administrative account. The issue has been patched in version 1.8.11. Limited evidence is available; further review is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.