SQL Injection Vulnerability in CiviCRM by CiviCRM

CVE-2026-72558

What is CVE-2026-72558?

An SQL injection vulnerability in CiviCRM allows authenticated users at the staff level to execute a malicious query through the contact search feature. By leveraging the RLIKE clause, attackers can concatenate unsanitized user inputs into the SQL statement, leading to unauthorized access to sensitive database information. This flaw enables potential exfiltration of critical records, including donor and member data, posing a significant security risk. Proper input validation and sanitization mechanisms must be employed to mitigate such vulnerabilities.

References