CVE-2026-72558

HIGH 8.8

CiviCRM CiviCRM - SQL Injection

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

CWE	CWE-89
Vendor	civicrm
Product	civicrm
Published	Aug 11, 2026
Last Updated	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for civicrm civicrm

Be the first to know when new high vulnerabilities affecting civicrm civicrm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

CiviCRM / CiviCRM

0 ≤ 6.18.alpha1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/civicrm/civicrm-core

Credits

Bobur Abdugafforov