ETK-2026-3455Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3455",
  "cve_id": null,
  "display_id": "ETK-2026-3455",
  "ghsa_id": "GHSA-cphx-cx67-jcqj",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Authenticated SQL injection in Craft CMS",
  "summary": "Craft CMS versions before 5.11.5 are affected by an SQL injection flaw in request handling for element lookup criteria. An authenticated attacker may read database data, including through actions available without assigned permissions; public registration can provide the required account.",
  "mitigation": "Upgrade craftcms/cms to version 5.11.5 or later. Until upgraded, disable public registration and restrict access to affected application actions to trusted authenticated users.",
  "vendor": "composer",
  "product": "composer:craftcms/cms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.0.0, < 5.11.5"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "5.11.5"
      ],
      "package_name": "craftcms/cms",
      "purl": "pkg:composer/craftcms/cms"
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 32.140664466666664,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T19:04:25+00:00",
      "days": -1.566729722962963,
      "is_lower_bound": true,
      "measured_at": "2026-11-04T08:40:30.484018+00:00",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-cphx-cx67-jcqj"
    }
  }
}