CVE-2026-88756: Pagekit CMS SQL Injection Vulnerability

CVE-2026-88756 Overview

CVE-2026-88756 is a SQL injection vulnerability in Pagekit CMS versions <= 1.0.18. The flaw resides in the public login endpoint POST /user/authenticate, which accepts a credentials array from unauthenticated clients. An attacker can inject SQL payloads through this array to manipulate the authentication query executed by the backend database.

Because the endpoint requires no prior authentication, exploitation is remotely reachable by any client that can send HTTP requests to the Pagekit instance. The vulnerability affects the core user authentication flow, placing credential data and any information accessible to the CMS database user at risk.

Critical Impact
Unauthenticated attackers can inject arbitrary SQL through the login endpoint, enabling database extraction, credential theft, and potential authentication bypass in Pagekit CMS deployments.

Affected Products

Pagekit CMS versions <= 1.0.18
The POST /user/authenticate endpoint handling the credentials array
Any Pagekit deployment exposing the login endpoint to untrusted networks

Discovery Timeline

2026-09-21 - CVE-2026-88756 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88756

Vulnerability Analysis

The vulnerability is a SQL injection [CWE-89] in Pagekit CMS's user authentication handler. The endpoint POST /user/authenticate receives a credentials parameter structured as an array. Values inside this array are incorporated into a database query without sufficient parameterization or type validation.

An attacker submits crafted values in the credentials fields to alter the query logic. Successful injection can return unintended rows, disclose database contents, or influence authentication decisions. The affected code path is exposed to unauthenticated users because it is the login endpoint itself.

The EPSS score is 0.212% with a percentile of 10.159, reflecting current observed exploitation likelihood. However, unauthenticated SQL injection in a public login endpoint remains a high-value target for opportunistic scanning.

Root Cause

The root cause is unsafe handling of user-supplied input inside the credentials array before it reaches the database layer. Pagekit's authentication logic does not enforce strict typing or parameter binding on each array element. Attacker-controlled strings are concatenated or interpolated into a SQL statement, allowing injection.

Attack Vector

An unauthenticated attacker sends a crafted HTTP POST request to /user/authenticate with SQL syntax embedded in the credentials fields. The malicious payload executes within the database context used by the CMS. The attack requires only network access to the Pagekit web interface and no user interaction.

No verified proof-of-concept code is published with the CVE record. Technical details are referenced in the public disclosure repository and the Pagekit CMS source repository.

Detection Methods for CVE-2026-88756

Indicators of Compromise

HTTP POST requests to /user/authenticate containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( inside the credentials fields
Unusually long or malformed credentials array values in web server access logs
Database errors or unexpected query latency correlated with authentication requests
Repeated failed authentication attempts from a single source followed by successful logins from unknown accounts

Detection Strategies

Inspect web server and application logs for anomalous request bodies targeting /user/authenticate
Deploy web application firewall (WAF) signatures for SQL injection patterns against the Pagekit login route
Monitor database query logs for tautologies, time-based delays, or UNION-based statements originating from the authentication code path
Correlate authentication endpoint activity with outbound data transfer volume to identify potential exfiltration

Monitoring Recommendations

Enable verbose logging on the Pagekit application and forward logs to a centralized SIEM for retention and correlation
Alert on any 500 or database error responses returned by /user/authenticate
Track baseline request volume to the login endpoint and alert on statistical anomalies
Review new administrative user accounts and privilege changes on a scheduled cadence

How to Mitigate CVE-2026-88756

Immediate Actions Required

Restrict network access to the Pagekit administrative and login endpoints using firewall rules or IP allowlisting
Deploy a WAF rule set that blocks SQL injection payloads targeting the credentials parameter on /user/authenticate
Audit database accounts used by Pagekit and enforce least privilege on the CMS database user
Rotate credentials and session secrets if exploitation is suspected

Patch Information

No vendor patch is referenced in the current CVE record. Administrators should monitor the Pagekit CMS repository for updates beyond version 1.0.18 and apply security releases as they become available. Until a fix is published, apply the compensating controls listed below.

Workarounds

Place Pagekit behind an authenticating reverse proxy to prevent unauthenticated internet exposure of /user/authenticate
Configure a WAF to reject requests where credentials array values contain SQL metacharacters or exceed expected length
Revoke FILE, DDL, and unnecessary write privileges from the CMS database account to limit injection impact
Consider taking affected instances offline if they host sensitive data and cannot be shielded by network controls

bash

# Example WAF rule (ModSecurity) blocking SQL metacharacters in credentials field
SecRule REQUEST_URI "@streq /user/authenticate" \
  "phase:2,chain,deny,status:403,id:1026887560,\
   msg:'Potential SQLi in Pagekit credentials array (CVE-2026-88756)'"
  SecRule ARGS_NAMES|ARGS "@rx (?i)(union\s+select|sleep\s*\(|--|';|/\*)" \
    "t:none,t:urlDecodeUni"