CVE-2026-72558 in CiviCRM
Summary
by MITRE • 08/11/2026
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical sql injection flaw in the civicrm content management system that affects versions through 6.18.alpha1. The security issue stems from improper input validation within the contact search functionality where the rlike clause fails to sanitize user-supplied parameters before incorporating them into database queries. The flaw exists specifically in how the system handles regular expression matching operations during contact searches, creating an avenue for malicious data manipulation through crafted input strings that bypass normal security controls.
The technical implementation of this vulnerability leverages the rlike operator which is designed for pattern matching within mysql databases. When authenticated staff members submit search queries using the contact search interface, the application directly concatenates user-provided values into sql statements without proper escaping or parameterization. This creates a classic sql injection vector where attackers can manipulate the underlying database commands to extract unauthorized information. The vulnerability specifically targets the regular expression matching functionality rather than standard sql injection points, making it particularly insidious as it operates within what appears to be a legitimate search feature.
The operational impact of this vulnerability is severe and far-reaching for organizations using civicrm for donor management, member databases, and contact tracking. An attacker with staff-level access can exploit this weakness to gain complete read access to the entire database schema, including sensitive information such as donor records, membership details, personal contact information, and potentially financial data. This represents a significant breach of data confidentiality and could lead to identity theft, fraud, or other malicious activities targeting individuals whose information is stored in the system. The attack requires only basic staff authentication credentials, making it particularly dangerous as it can be exploited by insiders or compromised accounts with legitimate access rights.
Organizations should immediately implement multiple layers of mitigation strategies to address this vulnerability. The primary fix involves sanitizing all user inputs within the rlike clause functionality through proper parameterization of sql queries and implementing input validation that prevents malicious regular expression patterns from being executed. Security patches should be applied as soon as available from the civicrm development team, with immediate rollback procedures in place for systems where patching may not be immediately feasible. Network segmentation and access controls should be enforced to limit staff access to database resources, while monitoring systems should be enhanced to detect unusual search pattern activities that might indicate exploitation attempts. This vulnerability aligns with cwe-89 sql injection and follows attack patterns documented in the mitre att&ck framework under initial access and credential access techniques. Organizations should also consider implementing web application firewalls and database activity monitoring solutions to provide additional protection against similar vulnerabilities in other components of their infrastructure.
The broader implications extend beyond this specific vulnerability to highlight the importance of secure coding practices in web applications. This flaw demonstrates how seemingly benign search functionality can become a critical security risk when proper input validation is omitted, emphasizing the need for comprehensive security testing including sql injection vulnerability assessments during development cycles. The incident underscores the necessity of implementing defense-in-depth strategies that protect against both external and internal threats, particularly in systems handling sensitive personal data where unauthorized access could have significant legal and regulatory consequences under data protection frameworks such as gdpr or ccpa.