---
id: "CVE-2026-123488"
page: "https://infrastack.ai/live/CVE-2026-123488"
kind: "vulnerability"
aliases: ["CVE-2026-123488"]
title: "Craft CMS: unauthenticated SQL injection lets attackers take admin access"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["craft-cms", "php", "runtime", "self-hosted"]
not_affected_if: ["fixed-version", "no-internet-exposure"]
published_at: "2026-11-06T15:17:18+00:00"
first_seen_at: "2026-11-06T15:42:44+00:00"
updated_at: "2026-11-06T15:43:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123488", "first_seen_at": "2026-11-06T15:42:44+00:00"}]
exploit_sources: []
---

# Craft CMS: unauthenticated SQL injection lets attackers take admin access

Link for people: https://infrastack.ai/live/CVE-2026-123488 (this .md is for agents)

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 let anyone send a crafted request to the element search endpoint and inject SQL. An attacker can read and write the database, including setting the admin flag or overwriting password hashes in the users table to gain administrator access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Craft version in `composer.json` or with `composer show craftcms/cms`
- Confirm whether the site exposes the element search endpoint to the internet

## Fix

- Craft CMS 4.x: move to `4.18.9` or later
- Craft CMS 5.x: move to `5.11.2` or later

## Timeline

- 2026-11-06T15:42:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123488

## Documents

- [advisory] Vendor advisory: github.com https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-sql-injection-via-element-search-endpoint

## From the sources

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_