Security Advisory
CVE-2026-72558
8.8
HIGH
Vulnerability Description
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.
Published Date
August 11, 2026
Official Source
NIST NVD Advisory