CVE-2026-72558

HighCVSS 8.8

Published: 11/08/2026(UTC)Updated: 24/10/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

36th percentile - higher than 36% of all known CVEs

Summary

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The user-supplied value is concatenated without sanitization.

Risk Assessment

The organization is exposed to exfiltration of all data, including donor and member records, potentially compromising privacy and trust.

Recommendation

Update CiviCRM to a patched version or use parameterized SQL queries.

Other vulnerabilities in CiviCRM

CVE-2025-65187Medium
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field, which executes whenever the page is viewed.

Original NVD description (English source)

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS