The vulnerability is an unauthenticated SQL injection in the element search endpoint of Craft CMS. An attacker can craft the attribute parameter to inject SQL, enabling reading or modifying database content. The flaw allows an attacker to set the admin flag or overwrite password hashes in the users table, effectively turning a non‑administrator into an administrator. This is a classic SQL injection weakness (CWE‑89). The likely attack vector is sending a crafted HTTP request to the vulnerable endpoint with a specially formatted attribute parameter, and based on the description it is inferred that the exploit requires no prior authentication.

Affected are Craft CMS releases from version 4.0.0 through 4.18.8 and from 5.0.0 through 5.11.1. The vulnerability is fixed in Craft CMS 4.18.9 and 5.11.2.

The CVSS base score of 9.3 indicates critical severity. EPSS score is not available, but the flaw is unauthenticated, allowing remote attackers to exploit it without credentials. It is not listed in the CISA KEV catalog. An attacker can directly interact with the vulnerable endpoint, inject SQL, read or write database values, and elevate privileges to administrator, making the likelihood of real‑world exploitation high.