CVE-2026-8054
Last modified
CVE-2026-8054 is a critical-severity vulnerability rated 10/10 on the CVSS scale. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. EPSS estimates a 1.58% chance of exploitation in the next 30 days.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-8054?
How severe is CVE-2026-8054?
How do I fix CVE-2026-8054?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8048The My Email Shortcode plugin for WordPress is vulnerable to…6.4
- CVE-2026-8049In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo dev…5.3
- CVE-2026-8050In SignalRGB versions prior to 1.3.7.0, seven of the thirtee…7.5
- CVE-2026-8051OS command injection in Ivanti Virtual Traffic Manager befor…7.2
- CVE-2026-8052HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulner…6
- CVE-2026-8053An issue in MongoDB Server's time-series collection implemen…8.8
- CVE-2026-8055Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2026-8056IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated u…8.8
- CVE-2026-8058IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 throu…4.5
- CVE-2026-8059IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigato…6.1
- CVE-2026-8063An authenticated user can crash mongod when running $rankFus…7.1
- CVE-2026-8069PredatorSense version 3.00.3136 to 3.00.3196 contain Local P…7.8
Are you affected by CVE-2026-8054?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST