CVE-2026-31891: Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

This is a SQL Injection vulnerability in the MongoLite Aggregation Optimizer.

Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected.

Who is impacted:

• Any deployment where the /api/content/aggregate/{model} endpoint is publicly accessible or reachable by untrusted users.
• Attackers in possession of a valid read-only API key (the lowest privilege level) can exploit this vulnerability — no admin access is required.

What an attacker can do:

• Inject arbitrary SQL via unsanitized field names in aggregation queries.
• Bypass the _state=1 published-content filter to access unpublished or restricted content.
• Extract unauthorized data from the underlying SQLite content database.

Confidentiality impact is High. Integrity and availability are not directly affected by this vulnerability.