---
id: 6164
title: "CVE-2026-8054 — dotCMS Core Publish Audit API SQL Injection"
cve: CVE-2026-8054
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260527-cve-2026-8054-dotcms-core-publish-audit-api-sql-injection/"
published_at: "2026-05-27T00:00:00Z"
tags: ["vulnerability-research", "sql-injection", "pre-auth", "cve-2026-8054", "dotcms", "content-management-system"]
phying_url: "https://phying.com/item/6164"
lang: en
---

# CVE-2026-8054 — dotCMS Core Publish Audit API SQL Injection

## Summary

CVE-2026-8054: unauthenticated SQL injection in dotCMS's /api/auditPublishing/getAll endpoint gives full read, modify and delete access to the PostgreSQL database in one request.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-8054
- **Published:** 2026-05-27T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260527-cve-2026-8054-dotcms-core-publish-audit-api-sql-injection/
- **Phying News:** https://phying.com/item/6164