An unauthenticated SQL Injection flaw exists in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) of dotCMS Core. Unsanitized user input is directly incorporated into dynamically constructed SQL statements, enabling attackers to read, modify, or delete arbitrary database records. This weakness falls under CWE‑89 and can lead to data loss, tampering, and potential escalation of privileges if the database contains application logic or stored procedures that execute with higher privileges.

The vulnerability affects dotCMS Core versions 25.11.04‑1 through 26.04.28‑02. Versions after 26.04.28‑02, including LTS releases, are not impacted because the offending code path was never backported.

The CVSS score of 10 indicates high severity. EPSS data is not available, but the lack of authentication on the API surface delivers a clear, network‑based attack vector, making exploitation straightforward for an outside attacker. The vulnerability is not listed in the CISA KEV catalog. The fix requires upgrading to dotCMS Core 26.04.28‑03 or later, which enforces authentication and publication‑queue permissions before processing requests.