CVE-2026-8054 Details
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
A SQL injection vulnerability has been identified in the Publish Audit API endpoints of dotCMS Core versions 25.11.04-1 through 26.04.28-02. This vulnerability allows remote unauthenticated attackers to read, modify, or delete arbitrary database content. The issue arises because the endpoints did not enforce authentication and accepted unsanitized input that was directly interpolated into SQL queries. The vulnerability was introduced in the current release track and was never backported to LTS releases, which are not affected.
The vulnerability has been fixed in dotCMS Core version 26.04.28-03. Organizations using affected versions should upgrade to this version. The fix includes authentication enforcement, requiring an authenticated backend user with the publishing-queue portlet permission, and the use of parameterized queries to prevent SQL injection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75 | [email protected] | AdvisoryRemedyVendor |
| https://github.com/dotCMS/core/pull/35553 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dotCMS | >= 25.11.04-1, <= 26.04.28-02 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |