CVE-2026-115192 Details
Description
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.
A SQL injection vulnerability has been identified in the dashboard widget data API endpoint (/api/data/{type}) of Mautic. This issue affects versions 2.8.1 prior to 5.2.12, 6.0.0 prior to 6.0.10, and 7.0.0 prior to 7.2.2. The vulnerability arises because chart filter parameters from the client are not adequately validated before being used in database queries that generate dashboard chart data. An authenticated user with API access can exploit this flaw to inject SQL into the reporting queries. Exploitation requires the Mautic API to be enabled.
Users can upgrade to Mautic versions 5.2.12, 6.0.10, or 7.2.2 to address this vulnerability. For those using legacy Mautic 4 releases, general security support is available through the Extended Long-Term Support (ELTS) program. If an immediate upgrade is not possible, the Mautic API can be disabled or API access restricted to trusted users only.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mautic/mautic/security/advisories/GHSA-qpmx-7pq3-5q2v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mautic | >= 2.8.1, < 5.2.12 (semver) >= 6.0.0, < 6.0.10 (semver) >= 7.0.0, < 7.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |