CVE-2026-72558: CiviCRM CiviCRM - SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-24
Weakness: CWE-89

Description

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

Affected products

CiviCRM: through 6.18.alpha1

References

https://github.com/civicrm/civicrm-core

Get alerted when CVE-2026-72558 or the next vulnerability affects your stack