Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-55572: e107 CMS alt_auth login can be hijacked
CVE-2026-55572 · published 4 days ago
Summary
The alt_auth add‑on in e107 versions before 2.3.7 lets a bad actor place malicious code into the username field, which is then run as a database command. This can let an unauthenticated user view or change data in the external database used for authentication. Update e107 to version 2.3.7 or later to stop the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| e107inc | e107 | < 2.3.7 |
Original advisory text
e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
References
- https://github.com/e107inc/e107/commit/120bd4bdbe18c8690c60a007ad6716e52e6ee965
- https://github.com/e107inc/e107/releases/tag/v2.3.7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55572... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55572 Vendor Advisory
- https://github.com/e107inc/e107/security/advisories/GHSA-5f75-c25x-59wx
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta