Critical severity · published May 27, 2026
CVE-2026-8054
Unauthenticated SQL Injection in dotCMS Publish Audit API
10.0
CVSS
1.6%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
dotCMS Core · dotCMS
25.11.04-1 through 26.04.28-02 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8054
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8054
dev.dotcms.com
https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75
github.com
https://github.com/dotCMS/core/pull/35553
More from dotCMS Core
9.9
CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls
6.1
CVE-2024-3938
The "reset password" login page accepted an HTML injection via URL parameters
6.1
CVE-2023-3042
CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8
4.5
CVE-2024-3165
Database Credential Exposure in the Logs
4.5
CVE-2024-3164
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and…