CVE-2026-72558 CiviCRM CVE debrief

Who should care

Organizations using CiviCRM for donor and member record management, especially those with staff-level access to contact search functionality, should be aware of this vulnerability. They should review their CiviCRM installations, restrict staff access, and monitor database queries for suspicious activity. Security teams should prioritize patching or mitigating this vulnerability to prevent potential data breaches.

Technical summary

The SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization, enabling exfiltration of donor and member records. This vulnerability has a CVSS score of 8.8 and is classified as HIGH severity. The vulnerability can be exploited by authenticated staff to access sensitive data, including donor and member records, without proper authorization. It is crucial for organizations using CiviCRM to assess their installations and restrict staff access to contact search functionality to mitigate potential risks.

Defensive priority

Authenticated staff can exfiltrate database contents via SQL injection in CiviCRM contact search.

Recommended defensive actions

• Inventory CiviCRM installations for version 6.18.alpha1 or earlier
• Restrict staff access to contact search functionality
• Monitor database for suspicious queries
• Apply vendor patches or updates when available
• Implement additional security controls for database access

Evidence notes

The CVE Program record and NVD vulnerability detail confirm an SQL injection vulnerability in CiviCRM through 6.18.alpha1. The vulnerability allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. Evidence is limited to official CVE and NVD records. Defenders should verify CiviCRM installations and staff access levels.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.