CVE-2026-123488 · Runtime
NO FIX YET · SEE WHAT TO DO
Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 let anyone send a crafted request to the element search endpoint and inject SQL. An attacker can read and write the database, including setting the admin flag or overwriting password hashes in the users table to gain administrator access.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any site running Craft CMS 4.0.0 to 4.18.8 or 5.0.0 to 5.11.1 that exposes the element search endpoint to the internet is exposed, with no login needed. Sites on versions outside those ranges are not affected by this flaw. Teams that run Craft behind a restricted network or a managed host should still confirm the version.
Not affected if fixed-version, no-internet-exposure
Who cares craft-cms, php, self-hosted
composer.json or with composer show craftcms/cms4.18.9 or later5.11.2 or laterCraft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.