CVE-2026-123488

CVE-2026-123488 is an unauthenticated SQL injection vulnerability affecting Craft CMS versions 4.0.0 before 4.18.9, as well as versions 5.0.0 before 5.11.2. The flaw is located within the platform's element search endpoint, where the `attribute` parameter is concatenated directly into a database query without sanitization. Because the application runs with emulated PDO prepared statements, this lack of input validation allows stacked SQL statements to execute. By exploiting this vulnerability, remote attackers can read and write to the database without needing prior authentication. This allows unauthorized users to modify database contents, such as overwriting password hashes or setting the administrator flag in the users table to obtain full administrative access. The vulnerability has been patched in Craft CMS versions 4.18.9 and 5.11.2.