CVE-2026-72558

Summary

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

Affected Software

VendorProductVersion RangeStatus
CiviCRMCiviCRM0 <= 6.18.alpha1affected

Weaknesses

  • CWE-89: CWE-89: SQL Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References