CVE-2026-72558: CiviCRM SQL Injection Vulnerability

CVE-2026-72558 Overview

CVE-2026-72558 is a SQL injection vulnerability affecting CiviCRM through version 6.18.alpha1. The flaw resides in the contact search RLIKE clause, which concatenates a user-supplied value directly into the SQL query without sanitization. Authenticated users with staff-level access can exploit this weakness to read the entire backing database, including donor and member records. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Any authenticated staff account can exfiltrate the complete CiviCRM database, exposing personally identifiable information (PII), donor records, and financial contact data.

Affected Products

CiviCRM constituent relationship management platform
All CiviCRM releases through 6.18.alpha1
Deployments using the contact search functionality with RLIKE filtering

Discovery Timeline

2026-08-11 - CVE-2026-72558 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72558

Vulnerability Analysis

CiviCRM is an open-source constituent relationship management platform widely deployed by nonprofits, advocacy groups, and civic organizations. The contact search subsystem allows staff users to filter records using regular expression matching via the SQL RLIKE operator. The affected code path incorporates a user-controlled value into the generated SQL statement without applying parameterization or input escaping.

An authenticated staff-level attacker can inject arbitrary SQL syntax into the RLIKE clause. The injected payload executes with the database privileges assigned to the CiviCRM application user. In typical deployments, that account holds full read access to every table in the CiviCRM schema, including sensitive contact, contribution, and membership data.

Root Cause

The root cause is unsanitized string concatenation when building the RLIKE predicate for contact search queries. The application treats the search value as trusted input from an authenticated session rather than validating it against expected regular-expression syntax or binding it as a parameter. This pattern is a textbook case of [CWE-89] and bypasses the query builder protections used elsewhere in the codebase.

Attack Vector

Exploitation requires network access to the CiviCRM web interface and valid staff-level credentials. The attacker submits a crafted contact search request in which the RLIKE filter value contains SQL metacharacters and injected clauses. Because the vulnerability produces query results directly readable through the search interface, the attacker can perform in-band data exfiltration using UNION-based techniques without needing blind or time-based methods.

No public proof-of-concept exploit code has been released for CVE-2026-72558. Technical details for the affected component are available in the CiviCRM Core repository.

Detection Methods for CVE-2026-72558

Indicators of Compromise

Contact search requests containing SQL keywords such as UNION, SELECT, INFORMATION_SCHEMA, or SLEEP inside the RLIKE parameter
Unusually large or slow contact search responses returned to a staff session
Database query logs showing RLIKE predicates with unbalanced quotes, comment markers (--, #, /*), or nested subqueries
Sudden spikes in SELECT volume against civicrm_contact, civicrm_contribution, or civicrm_membership tables from the application account

Detection Strategies

Enable MySQL or MariaDB general query logging on CiviCRM database instances and alert on RLIKE clauses containing SQL syntax not produced by the standard search UI
Deploy a web application firewall (WAF) rule inspecting contact search endpoint parameters for SQL injection signatures
Correlate authenticated CiviCRM session activity with anomalous database read volumes exceeding baseline

Monitoring Recommendations

Monitor staff account authentication events for logins from unexpected IP ranges or outside business hours
Track outbound data volume from the CiviCRM application server for signs of bulk exfiltration
Review CiviCRM audit logs for repeated failed search queries that may indicate payload tuning by an attacker

How to Mitigate CVE-2026-72558

Immediate Actions Required

Upgrade CiviCRM to a fixed release published after 6.18.alpha1 as soon as the vendor makes it available
Audit accounts holding staff-level permissions and remove access that is not strictly required
Rotate credentials for the CiviCRM database user and any accounts whose data may have been exposed
Review recent contact search activity for evidence of exploitation attempts

Patch Information

Refer to the CiviCRM Core repository for the sanitization fix applied to the contact search RLIKE clause. Organizations should track upstream release notes and apply the patched version across all CiviCRM installations, including staging and development environments.

Workarounds

Restrict staff-level roles to a minimal set of trusted users until the patch is applied
Disable or hide the RLIKE contact search operator via role-based permissions where configurable
Place the CiviCRM interface behind a WAF configured to block SQL metacharacters in search parameters
Configure the CiviCRM database user with read-only access limited to required tables where operationally feasible

bash

# Example WAF rule (ModSecurity) to block SQL keywords in contact search RLIKE parameter
SecRule ARGS_NAMES "@rx (?i)rlike" \
    "chain,id:1072558,phase:2,deny,status:403,msg:'Possible CVE-2026-72558 SQLi attempt'"
    SecRule ARGS "@rx (?i)(union\s+select|information_schema|sleep\s*\(|--|/\*)" \
        "t:none,t:urlDecodeUni"