External risk intelligence

dotCMS SQL Injection in Audit Publishing API Endpoints

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-8054

The vulnerability exists in API endpoints within a content management system. These types of web application APIs are commonly deployed as internet-facing services to facilitate content publishing and management functions, making them reachable in typical web-based deployment architectures.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts content management systems, allowing unauthenticated attackers to potentially access and alter sensitive database information through specific API endpoints. The main concern is confirming whether your organization uses the affected technology and is exposed.

API flaw lets outsiders access database.
Confirms exposure in content management.
Focus on confirming relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target specific API endpoints in dotCMS Core to inject malicious SQL commands. These endpoints, which handle audit publishing, are exposed externally and do not require any authentication to access. By submitting unsanitized input, an attacker can manipulate the database, potentially leading to unauthorized data access, modification, or deletion.

Reachable via network.
Triggered by unauthenticated API calls.
Risk of database compromise.

Live Threat

Current exploitation, exposure, and threat context

Remote, unauthenticated attackers could read, modify, or destroy arbitrary database content through the Publish Audit API endpoints when conditions supported by the advisory are met. This occurs because the endpoints do not enforce authentication and accept unsanitized input for SQL queries.

Arbitrary database content.
Unsanitized input to API endpoints.
Data destruction or unauthorized modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in dotCMS Core's Publish Audit API endpoints requires immediate attention from teams managing application infrastructure and the dotCMS platform. The first practical step is to identify all instances of the affected dotCMS versions, confirm their external reachability and business criticality, and then determine the accountable application or platform owner to initiate remediation planning.

Application owners and platform teams should own remediation.
Verify API endpoint reachability and business criticality.
Plan and execute remediation in a maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is dotCMS Core?

dotCMS Core is a Java-based content management system (CMS). It provides tools for organizations to build, manage, and deliver web content across various channels. The software architecture includes specific API endpoints, such as the Audit Publishing API, designed to handle background tasks related to content tracking and synchronization.

How does CVE-2026-8054 cause a security risk?

This vulnerability is classified as an SQL Injection (CWE-89). It occurs when the software takes user-supplied data and incorporates it directly into database queries without proper filtering. In this case, the flaw allows an attacker to send crafted input that the system interprets as a database command, granting them the ability to read, change, or delete data stored in the backend.

Do I need to be logged into dotCMS to trigger this vulnerability?

No. The vulnerability exists specifically because the affected Publish Audit API endpoints do not require authentication. An attacker can trigger the issue by sending unauthenticated web requests to these specific API paths. Legitimate actions that do not involve sending unsanitized data to these specific audit endpoints are not the mechanism that triggers this bug.

Is my dotCMS instance at risk if it is internal only?

Halo Surface Signal indicates that these API endpoints are commonly deployed as internet-facing services to support content publishing, which increases the likelihood of reachability. If your instance is strictly internal and unreachable from the internet, the attack surface is reduced; however, you should still confirm if the application is accessible to any untrusted network segments.

When should I prioritize fixing this dotCMS issue?

You should prioritize this immediately if you are running any version from 25.11.04-1 through 26.04.28-02. Start by identifying where these versions are deployed in your environment. Once identified, coordinate with the platform owners to schedule an update to version 26.04.28-03 or higher, which secures the endpoints by enforcing required backend permissions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.