CVE-2026-72558 — CiviCRM CiviCRM - SQL Injection
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates…
Published: 2026-08-11 · CVSS: 8.8 · CVSS 3.1
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7