{"id":"CVE-2026-123488","kind":"vulnerability","aliases":["CVE-2026-123488"],"related":[],"title":"Craft CMS: unauthenticated SQL injection lets attackers take admin access","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","summary":"Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 let anyone send a crafted request to the element search endpoint and inject SQL. An attacker can read and write the database, including setting the admin flag or overwriting password hashes in the users table to gain administrator access.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","php","runtime","self-hosted"],"not_affected_if":["fixed-version","no-internet-exposure"],"how_to_check":"- Check the installed Craft version in `composer.json` or with `composer show craftcms/cms`\n- Confirm whether the site exposes the element search endpoint to the internet","fix":"- Craft CMS 4.x: move to `4.18.9` or later\n- Craft CMS 5.x: move to `5.11.2` or later","status":"open","published_at":"2026-11-06T15:17:18+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:43:58+00:00","updated_at":"2026-11-06T15:43:58+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-06T15:43:58Z","model":"claude-haiku-5-5","output":{"fix":"- Craft CMS 4.x: move to `4.18.9` or later\n- Craft CMS 5.x: move to `5.11.2` or later","reach":"internet","title":"Craft CMS: unauthenticated SQL injection lets attackers take admin access","impact":"high","summary":"Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 let anyone send a crafted request to the element search endpoint and inject SQL. An attacker can read and write the database, including setting the admin flag or overwriting password hashes in the users table to gain administrator access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["craft-cms","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads and writes the database and gains administrator access","analyst_note":"Confirm whether the element search endpoint is reachable by default in affected versions, and check the vendor advisory on github.com for the exact default configuration.","how_to_check":"- Check the installed Craft version in `composer.json` or with `composer show craftcms/cms`\n- Confirm whether the site exposes the element search endpoint to the internet","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-internet-exposure"],"who_is_affected":"Any site running Craft CMS 4.0.0 to 4.18.8 or 5.0.0 to 5.11.1 that exposes the element search endpoint to the internet is exposed, with no login needed. Sites on versions outside those ranges are not affected by this flaw. Teams that run Craft behind a restricted network or a managed host should still confirm the version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000747,"input_tokens":4330,"output_tokens":628,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-123488':13A,16A '-2026':12A,15A '4.0.0':28B,76C '4.18.9':30B,78C '5.0.0':32B,80C '5.11.2':34B,82C 'access':10A,73B,134C 'admin':9A,60B,121C 'administr':72B,133C 'allow':108C 'anyon':36B 'attack':7A,50B,112C 'attribut':96C 'cms':2A,19B,26B,75C 'concaten':99C 'contain':83C 'craft':1A,18B,25B,39B,74C 'craft-cm':17B 'cve':11A,14A 'databas':56B,118C 'element':43B,91C 'emul':105C 'endpoint':45B,93C 'flag':61B,122C 'gain':71B,132C 'hash':65B,126C 'host':24B 'includ':57B 'inject':5A,47B,87C 'let':6A,35B 'overwrit':63B,124C 'paramet':97C 'password':64B,125C 'pdo':106C 'php':20B 'prepar':107C 'queri':102C 'read':52B,114C 'remot':111C 'request':40B 'runtim':21B 'search':44B,92C 'self':23B 'self-host':22B 'send':37B 'set':58B,119C 'sql':4A,48B,86C 'stack':109C 'statement':110C 'tabl':69B,130C 'take':8A 'unauthent':3A,85C 'unsanit':103C 'user':68B,129C 'version':27B 'vulner':88C 'write':54B,116C","nicknames":[],"mitigations":[],"who_affected":"Any site running Craft CMS 4.0.0 to 4.18.8 or 5.0.0 to 5.11.1 that exposes the element search endpoint to the internet is exposed, with no login needed. Sites on versions outside those ranges are not affected by this flaw. Teams that run Craft behind a restricted network or a managed host should still confirm the version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["craftcms","critical","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123488':13A,16A '-2026':12A,15A 'access':10A 'admin':9A 'attack':7A 'cms':2A 'craft':1A 'cve':11A,14A 'inject':5A 'let':6A 'sql':4A 'take':8A 'unauthent':3A","search_b":"'4.0.0':28B '4.18.9':30B '5.0.0':32B '5.11.2':34B 'access':73B 'admin':60B 'administr':72B 'anyon':36B 'attack':50B 'cms':19B,26B 'craft':18B,25B,39B 'craft-cm':17B 'databas':56B 'element':43B 'endpoint':45B 'flag':61B 'gain':71B 'hash':65B 'host':24B 'includ':57B 'inject':47B 'let':35B 'overwrit':63B 'password':64B 'php':20B 'read':52B 'request':40B 'runtim':21B 'search':44B 'self':23B 'self-host':22B 'send':37B 'set':58B 'sql':48B 'tabl':69B 'user':68B 'version':27B 'write':54B","search_c":"'4.0.0':76C '4.18.9':78C '5.0.0':80C '5.11.2':82C 'access':134C 'admin':121C 'administr':133C 'allow':108C 'attack':112C 'attribut':96C 'cms':75C 'concaten':99C 'contain':83C 'craft':74C 'databas':118C 'element':91C 'emul':105C 'endpoint':93C 'flag':122C 'gain':132C 'hash':126C 'inject':87C 'overwrit':124C 'paramet':97C 'password':125C 'pdo':106C 'prepar':107C 'queri':102C 'read':114C 'remot':111C 'search':92C 'set':119C 'sql':86C 'stack':109C 'statement':110C 'tabl':130C 'unauthent':85C 'unsanit':103C 'user':129C 'vulner':88C 'write':116C","first_public_at":"2026-10-22T22:52:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123488","severity":null,"published_at":"2026-11-06T15:17:18+00:00","modified_at":"2026-11-06T15:17:18+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87556,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T22:52:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87557,"url":"https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-sql-injection-via-element-search-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}