SQL Injection Vulnerability in e107 CMS Affecting Authentication Plugins

CVE-2026-55572

What is CVE-2026-55572?

The e107 content management system (CMS) has a vulnerability that arises from improper handling of user input in authentication processes. Specifically, prior to version 2.3.7, the alt_auth plugin's otherdb and e107db authentication backends were susceptible to SQL injection due to the direct interpolation of user-submitted login usernames into SQL queries. This flaw allows unauthenticated users to exploit the vulnerability if the alt_auth is installed and either backend is configured to connect to a live external database. Successful exploitation enables attackers to reveal or alter data available through the database account, and failure of any queries may inadvertently disclose sensitive information through debug messages. This vulnerability has been addressed in version 2.3.7.

References