{"schema":"threatline.record/2","record":{"id":"CVE-2026-46531","aliases":["GHSA-37jj-rx8x-4wf2"],"summary":"Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)","details":"Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column. The fragment is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the standard graphs.php?action=actions&drp_action=8 (\"Apply Automation Rules\") bulk action. The result of the injected SELECT is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channe. This issue has been patched in version 1.2.31.","categories":["Applications & CMS"],"product":"cacti","vendor":"Cacti","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46531","source_modified_at":"2026-10-23T14:42:27.937Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"cacti","vendor":"Cacti","versions":[{"status":"affected","version":">= 1.2.27, < 1.2.31"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2","source_modified_at":"2026-06-18T20:17:28Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"","name":"cacti/cacti"},"range":">= 1.2.27, <= 1.2.30"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2","source_modified_at":"2026-06-18T20:17:28Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"","name":"cacti/cacti"},"version":"1.2.31"}],"cvss":5.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T14:42:27.937Z","modified_at":"2026-10-23T14:42:27.937Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-46531","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T14:42:27.937Z"},{"source":"GitHub Advisory Database","url":"https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-06-18T20:17:28Z"}],"sources":["CVE List","GitHub Advisory Database"],"references":[{"source":"CVE List","url":"https://github.com/Cacti/cacti/security/advisories/GHSA-37jj-rx8x-4wf2","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/Cacti/cacti/pull/7163","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T14:42:27.937Z","content_hash":"9fef56e93d960e2a8590ea71171430196bc313def68fb09d3c14737480b77962"}}