CVE-2026-123488
Last modified
CVE-2026-123488 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access..
Description
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| craftcms | cms | >= 4.0.0, < 4.18.9 |
| craftcms | cms | >= 5.0.0, < 5.11.2 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-123488?
How severe is CVE-2026-123488?
How do I fix CVE-2026-123488?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12343IBM MQ could allow an authenticated attacker to cause a deni…6.5
- CVE-2026-12345The cleanup of tempfile.TemporaryDirectory is vulnerable to …5.9
- CVE-2026-12348Address bar spoofing in Arc Search for Android allows a remo…7.4
- CVE-2026-123485Ground Station from 0.6.0 before 0.8.20 does not restrict th…6.5
- CVE-2026-123486WWBN AVideo 29.0 through 29.4.0 contains a race condition vu…5.3
- CVE-2026-123487Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 …7.5
- CVE-2026-123489Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contai…7.1
- CVE-2026-12349The Premium Addons for KingComposer plugin for WordPress is …5.3
- CVE-2026-123490Craft CMS from 5.8.17 before 5.11.2 contains a privilege esc…8.8
- CVE-2026-123491Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contai…8.2
- CVE-2026-123492SiYuan before 3.8.9 contains a nil pointer dereference vulne…4.9
- CVE-2026-1235The WP eCommerce WordPress plugin through 3.15.1 unserialize…6.5
Are you affected by CVE-2026-123488?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST