CVE-2026-8054: Unauthenticated SQL Injection in dotCMS Publish Audit API
dotCMS · dotCMS Core
Vendor fix available · Affected: dotCMS Core · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 75% of scored CVEs
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- dotCMS · dotCMS Corefrom 25.11.04-1 up to and including 26.04.28-02
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- dotCMS Core Publish Audit API - Unauthenticated SQL Injection · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- SQL Injection
- Vendor
- dotCMS
- Published
- May 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-8054 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.