CVE-2026-55572
10.0CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Unauthenticated attackers can execute arbitrary SQL queries against the backend database via the login form, reading or modifying data and potentially triggering debug query disclosures. They only need network access to an instance with the alt_auth plugin enabled and configured with an active external database connection.
Root cause
The alt_auth plugin directly concatenates unsanitized usernames into SQL query strings executed by PDO::query() in its otherdb and e107db authentication handlers.
Affected systems
e107 versions prior to 2.3.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade e107 to version 2.3.7 or later. As an immediate workaround, disable the alt_auth plugin or reconfigure authentication to not use the otherdb and e107db backends.
$ git pull origin master && git checkout v2.3.7AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.