SQL injection in Craft CMS - #VU159596
Published: November 6, 2026
Vulnerability identifier: #VU159596
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read and modify the Craft CMS application database and escalate to administrator.
The vulnerability exists due to unsanitized concatenation of the attribute parameter into SQL queries in the element search endpoint, where emulated prepared statements permit stacked query execution. An unauthenticated remote attacker can submit crafted search requests to modify an account's administrator flag, as demonstrated by updating and reading back that flag.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - addressed in versions 4.18.9, 5.11.2