CVE-2026-55572

Summary

The e107 CMS contains a SQL injection vulnerability in its alt_auth plugin where user input is directly interpolated into SQL queries without proper sanitization, allowing unauthenticated attackers to execute arbitrary SQL commands against external databases. This critical flaw can lead to data exposure or modification through the configured authentication backends.

Exploitability

Exploitation is straightforward for unauthenticated users who can trigger the alt_auth plugin with either otherdb or e107db backends configured with live database connections, requiring no additional authentication or complex setup.

Blast radius

The vulnerability affects installations using the alt_auth plugin with external database connections, potentially exposing or modifying sensitive data accessible to the configured database account, with impact scaling based on database permissions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.3.7 immediately to remediate this critical SQL injection vulnerability in the alt_auth plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.