CVE-2026-123488

What it is. Craft's advisory describes an unauthenticated SQL injection in the element search endpoint. The attribute parameter is added to the query without sanitizing, and because the database driver emulates prepared statements, an attacker can stack extra SQL statements after the search query. Craft says this gives read and write access to the whole application database, and that the write access was used to set the admin flag on user ID 1. The same method could overwrite any account's password hash.

Where the sources differ. Craft's advisory and the CVE record name the element search endpoint. The public proof of concept describes the entry point more narrowly, as any public page that passes a visitor's search input into an element query, and gives a search-results template as the example. It also says the attack works only on MySQL or MariaDB. Neither point appears in Craft's advisory. Until Craft says more, treat every site on an affected version as exposed, and use the database and template checks below to decide which sites to update first.

Checks, in three tiers. The first decides exposure. The second and third decide priority. Run these only on sites your organization owns.

1. Is the site on an affected version? This decides exposure. Run this from the project root to see the installed Craft version.
   composer show craftcms/cms
   The control panel shows it too, under Utilities, then System Report. Versions 4.0.0 to 4.18.8 and 5.0.0 to 5.11.1 are affected. 4.18.9, 5.11.2 and anything later are fixed.
2. Does the site run on MySQL or MariaDB? The proof of concept says it works only on these. The database driver is usually set in the project's .env file.
   grep CRAFT_DB_DRIVER .env
   A value of mysql covers both MySQL and MariaDB. The System Report also names the database.
3. Does a public page send visitor search input into a search query? This is the entry point the proof of concept describes. Search the site templates for search queries built from request parameters.
   grep -rnE "search\((.*)(param|request)" templates/
   A match on a page anyone can reach puts the site first in line. No match does not prove the site is safe, since Craft's advisory does not limit the flaw to templates.

Public code. fixedbyreboot/CVE-2026-123488-POC was posted on November 6 by a GitHub account with one public repository. Its README says it confirms the injection with a timing check, then by default sends a statement that sets a chosen user as an administrator, and that it "writes to the database." We read the code and did not run it, so we cannot say it works as described.

Craft's advisory lists no workaround, and no vendor or incident responder has published one. Updating to Craft 4.18.9, 5.11.2 or later is the only fix we can source. Both have been available since September 17, 2026.

No vendor or researcher has published indicators of exploitation for this CVE as of November 7, 2026. These come from what Craft's advisory and the proof of concept describe.

• Users who became administrators without a change your team made. Craft's advisory says the flaw was used to set the admin flag on user ID 1. This query lists current admin accounts; add your table prefix if the site uses one.
  SELECT id, username, email, dateUpdated FROM users WHERE admin = 1;
• Password hashes that changed without a password reset. Craft says the same method could overwrite any account's password hash.
• Requests to search pages that carry bracketed search parameters, such as search[attribute], which is the parameter the proof of concept sends.
• Search requests that take several seconds longer than normal, which is how a timing check looks from the server side.

Is CVE-2026-123488 being exploited?

No exploitation has been reported, and it is not on CISA KEV as of November 7, 2026. A public proof of concept was posted on November 6. We read it and did not run it.

Which Craft versions are affected?

Craft 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1. Craft 4.18.9 and 5.11.2, released September 17, 2026, fix it, as does any later release.

If we updated Craft in September or October, are we covered?

Yes, if the site is on 4.18.9, 5.11.2 or later. The fix shipped on September 17. Craft published the advisory on October 22, and the CVE number came on November 6.

Is it Critical or High?

VulnCheck, which assigned the CVE, scores it 9.8, which is Critical. Craft's own advisory rates it High. NVD has not added its own score yet.

Does it affect sites on PostgreSQL?

The proof of concept says it works only on MySQL or MariaDB. Craft's advisory does not name a database. Update PostgreSQL sites too.

What should we check if a site was unpatched after October 22?

Review which accounts are administrators and whether any password hashes changed without a reset. Craft's advisory says the flaw can set the admin flag and overwrite password hashes in the users table.

Nov 7, 2026. First published. Public proof of concept since November 6; no exploitation reported; not on CISA KEV.

• Craft CMS advisory GHSA-qcvp-ggx3-97r6, SQL injection leading to privilege escalation (Oct 22, 2026)
• Craft CMS changelogs for 5.11.2 and 4.18.9 (Sep 17, 2026)
• CVE record for CVE-2026-123488 (VulnCheck CNA, Nov 6, 2026) and VulnCheck advisory
• NIST NVD: CVE-2026-123488 (Awaiting Analysis, checked Nov 7)
• Public code: fixedbyreboot/CVE-2026-123488-POC (Nov 6, 2026; read only, not run)
• CISA Known Exploited Vulnerabilities catalog (checked Nov 7)