CVE-2026-123488

Summary

An unauthenticated SQL injection flaw in Craft CMS's element search endpoint allows attackers to inject malicious SQL via the unsanitized 'attribute' parameter, enabling full database compromise including credential manipulation and privilege escalation.

Exploitability

Exploitation is trivial for remote attackers due to lack of authentication, low complexity, and no user interaction required.

Blast radius

Successful exploitation grants full database access, allowing attackers to escalate to administrator privileges by modifying the users table, leading to complete system compromise.

Detection

Look for SQL injection patterns (e.g., stacked queries like '; DROP TABLE; --) in HTTP request parameters targeting the element search endpoint, especially in logs from web application firewalls or application access logs.

Prioritized remediation

Upgrade to Craft CMS 4.18.9 or later for the 4.x branch, or 5.11.2 or later for the 5.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.