CVE-2026-52630

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52630
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52630.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52630
Published
2026-09-11T00:00:00Z
Modified
2026-10-21T02:30:33Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52630.json"
}
References

Affected packages

Git / github.com/woltlab/wcf

Affected ranges

Type
GIT
Repo
https://github.com/woltlab/wcf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
56fba016f0f14978e50131e54e6831c69227fd4a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "6.2.4"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.0_Beta_1
2.0.0_Beta_10
2.0.0_Beta_2
2.0.0_Beta_3
2.0.0_Beta_4
2.0.0_Beta_6
2.0.0_Beta_8
2.0.0_Beta_9
2.0.1
2.0.2
2.0.4
2.0.4_pl_1
2.1.0
2.1.0_Beta_1
2.1.0_Beta_2
2.1.0_Beta_4
2.1.0_RC_1
2.1.0_RC_2
2.1.1
2.1.10
2.1.11
2.1.2
2.1.2_pl_1
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.9_pl_1
3.*
3.0.0
3.0.0_Beta_3
3.0.0_Beta_4
3.0.0_Beta_5
3.0.0_RC_1
3.0.0_RC_2
3.0.0_RC_3
3.0.0_RC_4
3.0.1
3.0.1_pl_1
3.0.2
3.0.2_pl_2
3.1.0_Alpha_1
3.1.0_Alpha_2
3.1.0_Alpha_3
3.1.0_Alpha_4
3.1.0_Beta_1
3.1.0_Beta_2
3.1.0_Beta_3
3.1.0_Beta_4
3.1.0_Beta_5
5.*
5.2.0
5.2.0_Alpha_1
5.2.0_Alpha_2
5.2.0_Alpha_3
5.2.0_Beta_2
5.2.0_Beta_3
5.2.0_Beta_4
5.2.0_RC_1
5.2.0_RC_2
5.2.1
5.2.2
5.3.0_Beta_1
5.3.0_Beta_2
5.3.0_RC_1
5.3.0_RC_2
5.4.0_Alpha_1
5.4.0_Alpha_2
5.4.0_Alpha_3
5.4.0_Beta_1
5.5.0_Alpha_1
5.5.0_Alpha_2
5.5.0_Alpha_3
5.5.0_Alpha_4
5.5.0_Alpha_5
5.5.0_Alpha_6
5.5.0_Beta_1
6.*
6.0.0_Alpha_1
6.0.0_Alpha_2
6.0.0_Alpha_3
6.0.0_Alpha_4
6.0.0_Alpha_5
6.0.0_Alpha_7
6.0.0_Alpha_8
6.0.0_Beta_1
6.0.0_Beta_2
6.0.0_Beta_3
6.0.0_Beta_4
6.0.0_RC_1
6.1.0_Alpha_1
6.1.0_Alpha_2
6.1.0_Alpha_3
6.1.0_Beta_1
6.1.0_Beta_2
6.1.0_RC_1
6.2.0
6.2.0_Alpha_1
6.2.0_Alpha_3
6.2.0_Alpha_4
6.2.0_Beta_1
6.2.0_Beta_2
6.2.0_Beta_4
6.2.0_Beta_5
6.2.0_RC_1
6.2.0_RC_2
6.2.0_RC_4
6.2.1
6.2.1_dev_1
6.2.1_dev_2
6.2.2
6.2.3
6.2.3_dev_1
6.2.3_dev_2
6.2.3_dev_3
6.2.4
6.2.4_dev_1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52630.json"