Is CVE-2026-55572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55572 being exploited in the wild.

How severe is CVE-2026-55572?

Critical severity, with a CVSS score of 10, published 14 October 2026.

Is there a fix for CVE-2026-55572?

Yes: fixed in e107 2.3.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55572 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55572?

Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55572: e107 SQL injection in alt_auth authentication backends

CVE-2026-55572 · Severity: critical · CVSS 10 · Published 2026-10-14

e107 is a content management system that allows organizations to build and manage websites. The alt_auth plugin's login authentication backends interpolate user input directly into database queries without sanitization, allowing attackers to inject SQL commands. An unauthenticated attacker can expose or modify sensitive data stored in the configured database, potentially leading to complete system compromise.

Technologies: E107inc E107. Vendors: E107inc.

Quick answers

Is CVE-2026-55572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55572 being exploited in the wild.
How severe is CVE-2026-55572?: Critical severity, with a CVSS score of 10, published 14 October 2026.
Which products and versions are affected?: E107inc E107 prior to 2.3.7.
Is there a fix for CVE-2026-55572?: Yes: fixed in e107 2.3.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55572 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55572?: Check whether you run E107inc E107 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: e107 2.3.7

Technical details

The otherdb and e107db authentication backends in the alt_auth plugin's login() methods interpolate the submitted username into SQL queries and execute them with PDO::query() before sanitization, allowing unauthenticated SQL injection via the login parameter. The vulnerability requires alt_auth to be installed with either backend configured and a live external database connection. Query failures can disclose the generated SQL through debug messages.

Affected products

e107inc e107 prior to 2.3.7

Timeline

2026-06-14: disclosed: Fix committed to repository
2026-10-14: advisory: CVE-2026-55572 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.