PT-2026-43625 · Postgresql Global Development Group+1 · Postgresql+1

Published 2026-05-27 · Updated 2026-05-28 · CVE-2026-8054

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions dotCMS Core versions 25.11.04-1 through 26.04.28-02

Description Improper neutralization of special elements used in an SQL command allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The issue exists in the Publish Audit API endpoints "/api/auditPublishing/get" and "/api/auditPublishing/getAll", which do not enforce authentication and accept unsanitized input used in dynamically constructed SQL. This enables an attacker to impact the entire dotCMS PostgreSQL database with a single HTTP request.

Recommendations Update to version 26.04.28-03 or later to ensure the endpoints require an authenticated backend user with the publishing-queue portlet permission.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-8054

Affected Products

Postgresql

Dotcms Core

References · 4

• https://github.com/dotCMS/core/pull/35553 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8054 · Security Note
• https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75 · Vendor Advisory
• https://twitter.com/autumn_good_35/status/2060036414902075457 · Twitter Post