CVE-2026-115195Medium· 6.5▾ SunlitA broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables wit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
mautic/core >= 2.3.0 < 5.2.12mautic/core >= 6.0.0 < 6.0.10mautic/core >= 7.0.0 < 7.2.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
There are no official workarounds. To mitigate this vulnerability without upgrading, disable the API or restrict API access to trusted administrative users.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115191High· 7.1A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax)
CVE-2026-115192High· 7.1An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type})
CVE-2026-115188Critical· 9.9An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7
CVE-2026-115189High· 8.8A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic
CVE-2026-115193High· 8.2A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7
CVE-2026-115190High· 8.0An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties