CVE-2026-115191 Details
Description
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.
A SQL injection vulnerability has been identified in the Mautic administration interface, specifically within a contact lookup AJAX endpoint. This issue arises because a request parameter used to select the contact field for searching is not adequately validated before being incorporated into a database query. As a result, any authenticated Mautic user can exploit this vulnerability, regardless of their role or permissions. Exploitation can be carried out using blind SQL injection techniques, allowing attackers to execute arbitrary SQL queries against the Mautic database. This could lead to unauthorized access to sensitive data, including Mautic user accounts (with email addresses and password hashes), contact information, and content from campaigns and emails.
Users can upgrade to Mautic versions 5.2.12, 6.0.10, or 7.2.2 to address this vulnerability. For Mautic 4 releases, general security support is available through the Extended Long-Term Support (ELTS) program.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mautic/mautic/security/advisories/GHSA-fj8v-c9c3-7q26 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mautic | >= 2.1.0, < 5.2.12 (semver) >= 6.0.0, < 6.0.10 (semver) >= 7.0.0, < 7.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |