CVE-2026-123488

{
  "etk_id": "ETK-2026-3731",
  "cve_id": "CVE-2026-123488",
  "display_id": "CVE-2026-123488",
  "ghsa_id": "GHSA-qcvp-ggx3-97r6",
  "euvd_id": "EUVD-2026-118288",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in Craft CMS element search",
  "summary": "Craft CMS 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 are affected through the element search endpoint. An unauthenticated remote attacker may retrieve or alter database data, potentially leading to administrator access, when that endpoint is reachable.",
  "mitigation": "Upgrade craftcms/cms to 4.18.9 or later for the 4.x series, or to 5.11.2 or later for the 5.x series. Until upgraded, restrict unauthenticated access to the element search endpoint.",
  "vendor": "craftcms",
  "product": "cms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, < 4.18.9"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "4.18.9"
      ],
      "package_name": "craftcms/cms",
      "purl": "pkg:composer/craftcms/cms"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, < 5.11.2"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "5.11.2"
      ],
      "package_name": "craftcms/cms",
      "purl": "pkg:composer/craftcms/cms"
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.85459558333333,
  "t0_at": "2026-11-06T15:00:50.084000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-06T23:25:04.698428+00:00",
      "days": 0.35016914847222225,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T15:00:50.084000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-11-06T20:22:54+00:00",
      "days": 0.2236564351851852,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T15:00:50.084000+00:00",
      "url": "https://github.com/fixedbyreboot/CVE-2026-123488-POC"
    },
    "trigger_signal": {
      "at": "2026-11-06T15:00:50.084000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T15:00:50.084000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-123488"
    }
  }
}