CVE-2017-8874
HighSummary
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that can (1) delete email campaigns or (2) delete contacts.
Risk Assessment
Attackers can exploit these vulnerabilities to unauthorized delete important data, potentially leading to information loss and disruption of organizational operations.
Recommendation
It is recommended to update Mautic to the latest version to eliminate these vulnerabilities and implement additional CSRF protections.
Other vulnerabilities in Mautic 1.4.1
See all- CVE-2017-1000046High
Mautic version 2.6.1 and earlier fails to set flags on session cookies, which may lead to unauthorized access to user sessions.
- CVE-2026-9559Critical
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges can write arbitrary PHP files to sensitive system directories, leading to Remote Code Execution (RCE) under the web server user context.
- CVE-2026-9558Critical
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions, allowing authenticated users with theme creation or upload permissions to achieve remote code execution (RCE) and access restricted system files and configuration.
- CVE-2026-9811Medium
In Mautic 7, a stored XSS vulnerability exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the DOM, allowing an authenticated user to store a malicious script.
- CVE-2026-9809High
A stored XSS vulnerability exists in the Projects component of Mautic 7. User-supplied project names are rendered without proper sanitization in administrative views, allowing injection of malicious scripts.
- CVE-2026-9808High
An authorization bypass vulnerability exists in Mautic 7 API v2 (API Platform). Roles with owner-scope restrictions (e.g., `viewown`, `editown`) are not properly enforced, allowing low-privilege authenticated users to access or modify resources belonging to other users.
- CVE-2026-9557Medium
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.
- CVE-2026-4776High
An SQL injection vulnerability in Mautic's API contact filtering mechanism. An authenticated API user can bypass input filtering and inject arbitrary SQL commands due to insufficient recursive sanitization of nested query parameters.
Original NVD description (English source)
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete contacts.