{"id":"CVE-2026-123488","aliases":["EUVD-2026-118288","GHSA-qcvp-ggx3-97r6","GHSA-qvg8-69ff-cf67"],"status":"published","title":"Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01864,"percentile":0.79585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2026-11-06T15:00:50Z","modified":"2026-11-11T02:48:41Z","exploits":[{"source":"pocgithub","id":"fixedbyreboot/CVE-2026-123488-POC","title":"fixedbyreboot/CVE-2026-123488-POC","date":"2026-11-06","url":"https://github.com/fixedbyreboot/CVE-2026-123488-POC"},{"source":"pocgithub","id":"dinosn/CVE-2026-123488-CraftCMS-Lab","title":"dinosn/CVE-2026-123488-CraftCMS-Lab","date":"2026-11-08","url":"https://github.com/dinosn/CVE-2026-123488-CraftCMS-Lab"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-123488","title":"ashrafzaryouh/CVE-2026-123488","date":"2026-11-09","url":"https://github.com/ashrafzaryouh/CVE-2026-123488"},{"source":"pocgithub","id":"foxcornlab/craft-cms-scanner","title":"foxcornlab/craft-cms-scanner","date":"2026-11-09","url":"https://github.com/foxcornlab/craft-cms-scanner"},{"source":"nuclei","id":"CVE-2026-123488","title":"Craft CMS \u003c 4.18.9, \u003c 5.11.2 - Unauthenticated SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-123488.yaml"}],"products":[{"vendor":"craftcms","product":"cms"},{"vendor":"statamic","product":"cms"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6","tags":["vendor-advisory","advisory"]},{"url":"https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-sql-injection-via-element-search-endpoint","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123488","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qvg8-69ff-cf67"},{"url":"https://packagist.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115934.json","tags":["advisory"]},{"url":"https://github.com/craftcms/cms/releases/tag/5.11.2","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115934","tags":["advisory"]},{"url":"https://www.hckrt.com/hacktivity/HCKRT-Y64NY8","tags":["advisory"]},{"url":"https://github.com/craftcms/cms","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123488.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-123488","title":"Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","status":"published","published":"2026-11-06T15:00:50.084Z","modified":"2026-11-09T22:45:53.355Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-09T23:35:21.703923Z"}],"euvd":[{"id":"EUVD-2026-118288","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","status":"published","published":"2026-11-06T15:00:50Z","modified":"2026-11-09T22:45:53Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-10T00:18:43.414497Z"}],"ghsa":[{"id":"GHSA-qvg8-69ff-cf67","title":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection...","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","status":"published","published":"2026-11-06T15:31:27Z","modified":"2026-11-06T15:31:35Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-06T16:00:40.695019Z"}],"nvd":[{"id":"CVE-2026-123488","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","status":"published","published":"2026-11-06T15:17:18.133Z","modified":"2026-11-09T23:17:15.497Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-10T02:16:32.988634Z"}],"osv":[{"id":"CVE-2026-115934","title":"SQL injection leading to privilege escalation","description":"An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator.\n\n\n\nNote that this only affects MySQL/MariaDB.\n\nImpact  *  SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database.\n  *  Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash.\n\n\n\n\nUpdate to the patched versions (4.18.9 and 5.11.2) to get the fix.\n\n\n\nIf you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation.","status":"published","published":"2026-11-09T22:57:57.368Z","modified":"2026-11-12T02:30:40.14431704Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-11T03:22:00.901153Z"},{"id":"CVE-2026-123488","title":"Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","status":"published","published":"2026-11-06T15:00:50.084Z","modified":"2026-11-11T02:31:02.862311604Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-11T11:06:40.987816Z"}]}}