CVE-2026-123488

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.8 Craft CMS versions 5.0.0 through 5.11.1

Description An unauthenticated SQL injection exists in the element search endpoint. This occurs because the attribute parameter is concatenated into the query without proper sanitization, and emulated PDO prepares allow stacked statements. Remote attackers can read and write to the database, enabling them to set the admin flag or overwrite password hashes in the users table to obtain administrator access.

Recommendations Update Craft CMS versions 4.0.0 through 4.18.8 to version 4.18.9. Update Craft CMS versions 5.0.0 through 5.11.1 to version 5.11.2.