What is the CVSS score of CVE-2026-72558?

CVE-2026-72558 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of CiviCRM are affected by CVE-2026-72558?

CiviCRM versions through 6.18.alpha1 contain a SQL injection vulnerability in the contact search functionality that allows authenticated staff-level users to exfiltrate the complete backend database,…

How to fix or mitigate CVE-2026-72558?

Within 24 hours, audit all staff-level user accounts with CiviCRM database access and review recent access logs for contact search activity to identify any suspicious or unauthorized queries. Within 7 days, implement database activity monitoring and alerting for the contact search feature, reduce staff database permissions to minimum necessary access levels, disable the RLIKE operator in contact search if operationally feasible, and establish automated alerts for SQL error patterns in application logs. Within 30 days, develop a tested upgrade and deployment plan for CiviCRM versions beyond 6.18.alpha1 once a patched release becomes available from the vendor, and conduct security awareness training for all staff on principle-of-least-privilege access and reporting procedures.

CiviCRM CVE-2026-72558

EUVD-2026-56028 HIGH

SQL Injection (CWE-89)

2026-08-11 TuranSec

GHSA-h3jq-rqqh-3gvh

SQLi Civicrm

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible contact search requires only staff credentials (PR:L); unsanitized concatenation makes exploitation low-complexity with full database read/write impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:12 vuln.today

CVE Published

Aug 11, 2026 - 11:12 cve.org

HIGH 8.8

DescriptionCVE.org

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

AnalysisAI

SQL injection in CiviCRM through version 6.18.alpha1 allows authenticated staff-level users to exfiltrate the entire backend database via the contact search RLIKE clause. The vulnerability arises because user-supplied input is concatenated directly into the SQL query without sanitization, satisfying CWE-89. Sensitive records including donor, member, and organizational data are exposed to any user holding staff-level credentials. No public exploit or CISA KEV listing has been identified at the time of analysis, though the low exploitation complexity elevates real-world risk.

Technical ContextAI

CiviCRM is an open-source constituent relationship management (CRM) platform widely used by nonprofits, NGOs, and civic organizations. The affected component is the contact search feature, which constructs a SQL RLIKE (regular expression LIKE) clause by concatenating unsanitized user input directly into the query string. This violates the principle of parameterized queries and is the canonical CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) failure mode. The CPE string cpe:2.3:a:civicrm:civicrm:*:*:*:*:*:*:*:* confirms all CiviCRM application deployments through 6.18.alpha1 are affected, regardless of operating system or deployment environment. The underlying database engine is not specified but CiviCRM supports MySQL/MariaDB, where RLIKE maps to REGEXP, making the injection surface well-understood.

RemediationAI

No vendor-released patched version has been identified in the provided data - the GitHub repository at https://github.com/civicrm/civicrm-core should be monitored for a tagged release addressing this issue. Until a patch is available, organizations should restrict staff-level account creation and audit existing staff accounts, removing any accounts that do not require contact-search access. As a compensating control, deploying a web application firewall (WAF) rule to block RLIKE-based payloads in contact search parameters can reduce automated exploitation risk, though sophisticated attackers may bypass WAF rules. Database activity monitoring should be enabled to detect anomalous bulk SELECT queries originating from the CiviCRM application user. Restricting the CiviCRM database user's privileges to only the tables and operations strictly necessary (principle of least privilege) will limit the blast radius of a successful injection.