CVE-2026-123488: Unauthenticated SQL Injection in Craft CMS

CVE-2026-123488 describes an unauthenticated SQL injection vulnerability in Craft CMS, a widely-deployed open-source content management system used in enterprise and institutional environments. The flaw exists in the element search endpoint: the attribute parameter is concatenated into the query without sanitization. Emulated PDO prepared statements allow stacked statement execution, exposing the database to read and write operations without authentication. System administrators running Internet-facing Craft CMS instances must prioritize patching this vulnerability immediately.

The vulnerability carries a CVSS score of 9.8 (critical), confirmed in NVD data. Patches are available: version 4.18.9 for the 4.x branch, version 5.11.2 for the 5.0+ branch. The flaw became public concurrently with NVD notification (November 6, 2026). On X, 4 posts have appeared in the past 24 hours with approximately 9 total interactions, indicating high visibility within the IT security community. The unauthenticated nature of the vulnerability amplifies risk: no account is required to attempt exploitation from the Internet.

Immediate action: deploy Craft CMS 4.18.9 (4.x branch) or 5.11.2 (5.0+ branch) as soon as available, prioritizing Internet-exposed systems. For systems not yet patchable, implement network access controls (firewall, WAF) on the attribute parameter of the search endpoint, ideally restricting access to known trusted IP ranges. Monitor access logs to the search engine for unsanitized attribute parameters. Review database logs for modifications to user records and permission flags: a compromised administrator could have altered password hashes.

To verify if your environment is exposed, check which Craft CMS versions are deployed in production. Versions prior to 4.18.9 (4.x branch) and prior to 5.11.2 (5.0+ branch) are vulnerable. If the CMS is Internet-accessible and not patched, it is vulnerable to unauthenticated SQL injection attacks on this specific endpoint.