AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-72558

HIGH · CVSS 8.8 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-11 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

An SQL injection vulnerability in CiviCRM allows authenticated staff members to exploit the contact search functionality, enabling them to read the entire database due to unsanitized user input in the RLIKE clause. This high-severity flaw can lead to the exfiltration of sensitive data, including donor and member records. Organizations using CiviCRM should prioritize patching this vulnerability to protect their data integrity and confidentiality.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-72558
Severity
HIGH
CVSS
8.8
EPSS
0.24%

Original NVD Description

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.