CVE-2026-9808
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An authorization bypass vulnerability exists in Mautic 7 API v2 (API Platform). Roles with owner-scope restrictions (e.g., `viewown`, `editown`) are not properly enforced, allowing low-privilege authenticated users to access or modify resources belonging to other users.
Risk Assessment
The organization is at risk of unauthorized data access and modification by unprivileged users, potentially leading to information disclosure or system integrity compromise.
Recommendation
Immediately update Mautic to a patched version addressing CVE-2026-9808 and review API permission configurations to ensure owner-scope restrictions are correctly enforced.
Other vulnerabilities in Mautic
See all- CVE-2017-1000046High
Mautic version 2.6.1 and earlier fails to set flags on session cookies, which may lead to unauthorized access to user sessions.
- CVE-2017-8874High
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that can (1) delete email campaigns or (2) delete contacts.
- CVE-2026-9559Critical
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escape the intended temporary directories. An authenticated user with campaign import privileges can write arbitrary PHP files to sensitive system directories, leading to Remote Code Execution (RCE) under the web server user context.
- CVE-2026-9558Critical
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions, allowing authenticated users with theme creation or upload permissions to achieve remote code execution (RCE) and access restricted system files and configuration.
- CVE-2026-9811Medium
In Mautic 7, a stored XSS vulnerability exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the DOM, allowing an authenticated user to store a malicious script.
- CVE-2026-9809High
A stored XSS vulnerability exists in the Projects component of Mautic 7. User-supplied project names are rendered without proper sanitization in administrative views, allowing injection of malicious scripts.
- CVE-2026-9557Medium
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.
- CVE-2026-4776High
An SQL injection vulnerability in Mautic's API contact filtering mechanism. An authenticated API user can bypass input filtering and inject arbitrary SQL commands due to insufficient recursive sanitization of nested query parameters.
Original NVD description (English source)
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.