The vulnerability is an SQL injection flaw in the contact search functionality of CiviCRM, where the RLIKE clause is constructed by directly concatenating unsanitized user input into the SQL query. An attacker who has logged in with a staff role can inject arbitrary SQL, allowing them to read the entire database, including donor and member records. The weakness stems from lack of input validation and is classified as CWE‑89.

CiviCRM installations of any version up through and including 6.18.alpha1 are vulnerable. The flaw exists in the core contact search module and requires an authenticated staff account with search permissions. Any deployment of CiviCRM prior to the release that contains the RLIKE injection fix is considered affected until updated.

The CVSS score of 8.8 denotes high severity, reflecting the potential to compromise confidentiality and integrity. The EPSS score is not available, so exact exploit likelihood cannot be quantified, but the requirement of only staff credentials and the ubiquity of staff accounts suggest that the attacker window is wide. Because the issue is not listed in CISA KEV, large‑scale exploitation has not been observed yet, but the high score and lack of enumeration means timely patching is advised. The attack vector is likely an authenticated staff login followed by entry of a malicious RLIKE expression in the search interface.