CVE-2026-123488: Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
Event History
Frequently Asked Questions
Which Craft CMS installations are affected?
Craft CMS versions 4.0.0 through before 4.18.9 and 5.0.0 through before 5.11.2 are affected. Installations outside those stated version ranges are not identified as affected by the provided information.
Does exploitation require an authenticated Craft CMS account?
No. The vulnerable element search endpoint can be exploited without authentication by a remote attacker.
What could an attacker do after exploiting this issue?
An attacker can read from and write to the database. The described impact includes setting the administrator flag or overwriting password hashes in the users table to obtain administrator access.
What configuration condition enables the SQL injection?
The issue occurs because the endpoint concatenates the attribute parameter into a query without sanitization, while emulated PDO prepared statements permit stacked statements. The provided information does not state whether a non-default configuration is required.