CVE-2026-123488: Unauthenticated SQL Injection in Craft CMS
A critical vulnerability published on 6 November 2026 affects Craft CMS 4.x and 5.x. The flaw is an unauthenticated SQL injection in the element search endpoint. The CNA, VulnCheck, rated it CVSS 4.0 9.3. NVD lists it at 9.8, and VulDB scores it lower, at 7.3.
Technical Details
The attribute parameter of the element search endpoint is concatenated into the SQL query without sanitization. Craft runs PDO with emulated prepared statements, so stacked statements execute. An unauthenticated remote attacker therefore gets both read and write access to the application database.
The vendor advisory (GHSA-qcvp-ggx3-97r6) demonstrates the write primitive by setting the admin flag on user ID 1 in the users table. The same primitive can overwrite any account's password hash. That makes the flaw a path to full administrative takeover of the site.
Affected Versions
| Branch | Vulnerable | Fixed |
|---|---|---|
| Craft CMS 4.x | 4.0.0 up to, but not including, 4.18.9 | 4.18.9 |
| Craft CMS 5.x | 5.0.0 up to, but not including, 5.11.2 | 5.11.2 |
One source reports that the same release also fixes CVE-2026-123489, CVE-2026-123490 and CVE-2026-123491. That has not been confirmed independently here.
Exploitation Status
A public proof-of-concept repository is listed on Sploitus. It notes that any unauthenticated route feeding request input into an element query search is exposed. As of 6 November, OffSeq marked the CVE "not known to be exploited", although its honeypot sensors had recorded attack traffic. Given the public PoC, mass scanning is likely.
Remediation
- Upgrade to Craft CMS 4.18.9 or 5.11.2 as soon as possible.
- Audit the users table for unexpected admin flags, new accounts, or changed password hashes.
- Rotate credentials for Craft admins and any secrets stored in the database, such as API keys and integration tokens.
- Review web server and WAF logs for requests to the element search endpoint that carry SQL syntax in the
attributeparameter. - Use a WAF rule to block SQL metacharacters on that endpoint as a stopgap if you cannot patch immediately.