CVE Intelligence
Analysis AI-assisted

CVE-2026-12076: Raytha CMS SQL Injection in OData Filter Parsing

Raytha CMS contains an SQL injection flaw (CWE-89) in its OData filter parsing pipeline, which according to CERT Polska can be reached remotely without authentication. The CNA assigns a CVSS 4.0 base score of 9.3 and reports confirmation in version 1.5.2, with other versions possibly affected. No vendor fix appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-12076 describes an SQL injection weakness (CWE-89) in the OData filter parsing pipeline of Raytha CMS. According to the CNA, CERT Polska, the flaw is reachable by a remote attacker without authentication and targets a PostgreSQL backend. The original description is available in the CERT Polska advisory and the NVD entry.

Impact

  • The CNA states that an attacker could run arbitrary SQL statements against the underlying database.
  • The CNA describes the result as full database compromise, including credential extraction.
  • Confidentiality, integrity and availability impacts are rated high in the CVSS 4.0 vector supplied by the CNA.

Affected products and versions

  • Product: Raytha CMS (vendor site).
  • Confirmed version: 1.5.2, per the CNA description.
  • Other versions: the CNA states they may also be affected, but no list of affected versions is provided in the record.
  • No affected or fixed version ranges are listed in the sources consulted. This does not mean no fix exists; it means the information is unavailable in the record.

Exploitation status

  • CISA KEV does not list this CVE, so active exploitation is not reported by that catalogue.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS is 0.00531 with a percentile of 0.43361 in the record, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Identify all Raytha CMS deployments and confirm their exact versions, especially any running 1.5.2.
  • Because the CNA could not reach the vendor and no fix is listed, treat the product as unpatched until the vendor or a trusted source confirms otherwise.
  • Reduce exposure by limiting internet access to administrative and API endpoints that accept OData filter parameters, where feasible.
  • Apply the principle of least privilege to the database account used by the application, and rotate credentials stored in the database if exposure is suspected.
  • Monitor the CERT Polska advisory for updates.

Detection guidance

  • Review web and application logs for unusual or malformed OData filter parameters, particularly those containing database syntax or unexpected characters.
  • Review PostgreSQL logs for query errors, unusual query volumes or access to credential-related tables that the application does not normally use.
  • Treat unexplained database errors originating from the CMS as a potential indicator worth investigating.

Limitations of the available information

  • The record gives no list of affected or fixed versions beyond the confirmed version 1.5.2.
  • No vendor advisory, patch or workaround is available in the sources consulted.
  • The vendor did not respond to contact attempts, so the scope of the issue is not confirmed by the vendor.
  • The EPSS date in the record is not used for analysis beyond reporting the listed values.

Frequently asked questions

Which Raytha CMS version is confirmed as affected?

According to the CNA, the vulnerability was confirmed in version 1.5.2. The CNA states that other versions may also be affected, but no further version list is provided.

Is there a fix for CVE-2026-12076?

No fix is listed in the sources consulted. The record also notes that vendor contact attempts were unsuccessful, so administrators should treat the product as unpatched until a reliable source confirms a correction.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.