CVE-2026-115192High· 7.1▾ TwilightAn SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboa…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.
mautic/core >= 2.8.1 < 5.2.12mautic/core >= 6.0.0 < 6.0.10mautic/core >= 7.0.0 < 7.2.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
There are no official workarounds. To mitigate this vulnerability without upgrading, disable the Mautic API if it is not needed, or restrict API access to trusted users only.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115191High· 7.1A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax)
CVE-2026-4776High· 7.1Mautic has SQL Injection in API Contact Filtering
CVE-2026-115188Critical· 9.9An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7
CVE-2026-115189High· 8.8A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic
CVE-2026-115195Medium· 6.5A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table})
CVE-2026-115190High· 8.0An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties