CVE-2026-4776
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An SQL injection vulnerability in Mautic's API contact filtering mechanism. An authenticated API user can bypass input filtering and inject arbitrary SQL commands due to insufficient recursive sanitization of nested query parameters.
Risk Assessment
An attacker could gain unauthorized access to the database, steal or modify contact data, and potentially take control of the application.
Recommendation
Immediately update Mautic to the latest patched version and implement additional input validation mechanisms for the API.
Other vulnerabilities in Mautic
See all- CVE-2017-1000046High
Mautic version 2.6.1 and earlier fails to set flags on session cookies, which may lead to unauthorized access to user sessions.
- CVE-2017-8874High
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that can (1) delete email campaigns or (2) delete contacts.
- CVE-2026-9559Critical
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges can write arbitrary PHP files to sensitive system directories, leading to Remote Code Execution (RCE) under the web server user context.
- CVE-2026-9558Critical
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions, allowing authenticated users with theme creation or upload permissions to achieve remote code execution (RCE) and access restricted system files and configuration.
- CVE-2026-9811Medium
In Mautic 7, a stored XSS vulnerability exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the DOM, allowing an authenticated user to store a malicious script.
- CVE-2026-9809High
A stored XSS vulnerability exists in the Projects component of Mautic 7. User-supplied project names are rendered without proper sanitization in administrative views, allowing injection of malicious scripts.
- CVE-2026-9808High
An authorization bypass vulnerability exists in Mautic 7 API v2 (API Platform). Roles with owner-scope restrictions (e.g., `viewown`, `editown`) are not properly enforced, allowing low-privilege authenticated users to access or modify resources belonging to other users.
- CVE-2026-9557Medium
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.
Original NVD description (English source)
An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.