CiviCRM CVE-2026-72558

Exploitation requires a valid CiviCRM staff-level (authenticated, low-privileged) account - anonymous or unauthenticated access is insufficient. The vulnerable code path is the contact search feature's RLIKE clause, meaning the attacker must have access to that search functionality within the CiviCRM interface. No special non-default configuration is required; the contact search feature is part of CiviCRM's standard functionality. The primary limiting factor is the need for authenticated access: an organization with strong account lifecycle management, MFA enforcement on staff accounts, and minimal staff account provisioning will significantly reduce exposure. The vulnerability does not require any specific CiviCRM extension, plugin, or configuration mode to be active.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 and accurately reflects the threat model: network-accessible, low complexity, requiring only low-privileged (staff-level) authentication, with high impact across confidentiality, integrity, and availability. The PR:L rating is the critical limiting factor - exploitation is constrained to authenticated staff accounts, not anonymous users. No EPSS score was provided in the source data, and this CVE is not listed in the CISA KEV catalog, meaning active exploitation in the wild is not confirmed. No public proof-of-concept code was identified in the supplied references. Despite the absence of confirmed exploitation, the low attack complexity and the sensitivity of CiviCRM databases - which routinely hold donor financial records, member PII, and organizational contact lists - mean any organization running an affected version should treat this as urgent regardless of size.

An attacker with a valid staff-level CiviCRM account - obtained through credential theft, phishing, or insider access - navigates to the contact search interface and submits a crafted RLIKE value that breaks out of the intended query context and appends a UNION SELECT or stacked query to extract arbitrary table contents. Because attack complexity is low and no special configuration is required beyond having a staff account, the attacker can systematically dump donor records, financial data, and member PII from the database. No public proof-of-concept has been identified at the time of analysis, but the vulnerability class is well-understood and trivially exploitable by anyone with basic SQL injection knowledge.