Craft CMS Unauthenticated SQL Injection in Element Search (CVE-2026-123488)

CVE-2026-123488 sits in the element search endpoint of Craft CMS. The CVE record says the attribute parameter reaches the database query without sanitization. Because Craft's PDO layer runs with emulated prepares, an attacker's input can add stacked SQL statements that the database then executes.

What CVE-2026-123488 Lets an Attacker Do

The CVE record says the flaw needs no authentication and lets a remote attacker read and write the application database. It names two outcomes directly: setting the admin flag on a user account, and overwriting any account's password hash.

Craft CMS's own security advisory, GHSA-qcvp-ggx3-97r6, describes the same primitive in its own test. The write access set the admin flag on user ID 1, confirmed by reading the value back. The advisory says Craft short-circuits its permission checks on that single column, so no further change was needed to reach administrator access.

We leave out the request details that make stacked statements possible on this endpoint. Our SQL injection glossary entry explains the general pattern this flaw follows.

How the Score Reads

VulnCheck, the CNA, scores CVE-2026-123488 CVSS 3.1 9.8 Critical. The vector reads CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD also lists a CVSS 4.0 score of 9.3 Critical from the same source. Its vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

GitHub's own advisory page rates the issue High under its own severity scale and titles it "SQL injection leading to privilege escalation." Craft CMS's changelog groups the same advisory under its "permission escalation" fix line for both branches. The record and the vendor agree on the root cause, and both stress the path to administrator access.

What Craft CMS and CISA KEV Say

Craft CMS's own changelog lists GHSA-qcvp-ggx3-97r6 as fixed in 4.18.9 and 5.11.2, both released 17 September 2026, alongside two other high-severity advisories patched the same day. GitHub's advisory page confirms the same two patched versions and dates the advisory itself to 22 October 2026.

CVE-2026-123488 is not in the CISA KEV catalogue, version 2026.11.04. GitHub's advisory page still shows no linked CVE id, though the CVE record published 6 November 2026 cites the same advisory as its reference.

The CVE record lists Craft CMS 4.0.0 and later, before 4.18.9, and 5.0.0 and later, before 5.11.2, as affected. Craft CMS's own changelog and GitHub's advisory page both confirm the same two fixed versions.

Craft CMS runs as a Composer package, craftcms/cms, the same package GitHub's advisory names as affected. Any install on an affected 4.x or 5.x release needs the update in the table above.

The flaw is a textbook case of our Exploit Public-Facing Application technique. No account and only network access reach it, per the CVE record.