Unauthenticated SQL Injection in dotCMS Publish Audit API
dotCMS · dotCMS Core
A SQL injection flaw in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) of dotCMS Core, where unsanitized input is used in dynamically constructed SQL. An unauthenticated remote attacker over the network, with no user interaction and no special configuration required, can read, modify, or destroy arbitrary database content, since the endpoints do not enforce authentication.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 31 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 13 days after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+13 days
- First seen exploitedVulnCheck KEV evidence+31 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 10 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Known_Cve | Jun 5, 2026 | Part 1/24 Jun 2026
- Known_Cve | Jun 5, 2026 | Part 1/24 Jun 2026
- Known_Cve | Jun 4, 2026 | Part 1/23 Jun 2026
- Known_Cve | Jun 3, 2026 | Part 1/22 Jun 2026
- Known_Cve | Jun 2, 2026 | Part 1/21 Jun 2026
- Known_Cve | Jun 1, 2026 | Part 1/231 May 2026
- 4 more on OTX