Act nowDisclosed

Advisory · CVE-2026-123488

Unauthenticated Craft CMS SQL injection leads to admin takeover

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 lets an unauthenticated attacker inject SQL through the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements, giving database read and write access and a path to administrator.

Advisory published November 6, 2026Independent summary
Vendor
Craft CMS
Product
Craft CMS
Identifier / CWE
CVE-2026-123488
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

The search box builds its database question by pasting your words straight into it instead of checking them first. An attacker can paste extra instructions that the database follows, including flipping their own account to administrator.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Search request sent

    An unauthenticated attacker sends an element search request with a crafted attribute parameter.

  2. 02Parameter concatenated

    Craft CMS concatenates the attribute value into the SQL query without sanitizing it.

  3. 03Stacked statements run

    Because PDO runs with emulated prepares, the injected stacked statements execute against the application database.

  4. 04Database read and write

    The attacker reads and writes database rows, including the users table.

  5. 05Admin flag flipped

    The attacker sets the admin flag on a user account, or overwrites a password hash, and gains administrator access.

What happened

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint. The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. That gives an unauthenticated remote attacker read and write access to the application database. The vendor advisory confirms the write primitive was used to set the admin flag on user ID 1 in the users table, and that the same primitive can overwrite any accounts password hash. The record rates it critical at CVSS 9.8 under version 3.1 and 9.3 under version 4.0.

The fixed releases are 4.18.9 for the 4.x line and 5.11.2 for the 5.x line, per the NVD affected ranges and the 5.11.2 release notes. No authentication is required and the element search endpoint is reachable on an internet-facing install, so exposure is the default for unpatched public sites. The 5.11.2 release also fixes several other security issues; this advisory covers only this CVE.

What to do

  1. Inventory Craft CMS installations and record each version, including sites behind a CDN or reverse proxy.
  2. Upgrade 4.x installs to 4.18.9 or later and 5.x installs to 5.11.2 or later.
  3. Until upgraded, restrict access to the Craft install and treat the element search endpoint as untrusted input.
  4. Review web and database logs for unusual element search requests, stacked statements, and writes to the users table.
  5. Check the users table for unexpected admin flags or password hash changes, and rotate credentials for any account where tampering cannot be excluded.
  6. Verify the deployed version after updating.

Management note

An unauthenticated database write that ends in administrator is not a patch-only event. Upgrade first, then check the users table: if the write primitive was used, the evidence is sitting in the database, not in a log you may not have kept.