An unauthenticated SQL injection flaw in Craft CMS's element search endpoint lets remote attackers read and write the database and give themselves administrator access.
What Is It
CVE-2026-123488 is a SQL injection vulnerability (CWE-89) in Craft CMS's element search endpoint. According to the NVD record, the attribute parameter is put into the database query without sanitization. Craft CMS also uses emulated PDO prepares, which allow stacked statements. As a result, an attacker can run more SQL statements on top of the original query.
VulnCheck disclosed the flaw. NVD published it on 2026-11-06, and its status is currently "Awaiting Analysis."
Why It Matters
The attack needs no authentication and no user interaction, and it works over the network with low complexity. The NVD description says attackers can read and write the database. That includes setting the admin flag or overwriting password hashes in the users table to gain administrator access. The NVD description does not go beyond administrator access to describe further impact.
Severity ratings from VulnCheck:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL
As of publication, this CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV does not currently confirm active exploitation, and none of the sources cited here report exploitation in the wild.
What's Vulnerable
The affected product is Craft CMS (craftcms/cms) in these version ranges:
| Branch | Affected | First Unaffected |
|---|---|---|
| 4.x | 4.0.0 up to (not including) 4.18.9 | 4.18.9 |
| 5.x | 5.0.0 up to (not including) 5.11.2 | 5.11.2 |
The record marks versions outside these ranges as unaffected by default.
Patch Status
Fixed versions are available:
- Craft CMS 4.x: upgrade to 4.18.9 or later
- Craft CMS 5.x: upgrade to 5.11.2 or later
There is no CISA KEV required action or due date, because the CVE is not listed in the CISA KEV catalog. The flaw is unauthenticated, critical, and can lead directly to admin takeover, so Craft CMS operators should apply the fixed releases as a priority. See the vendor's GitHub security advisory for full remediation details.