CVE-2026-115195 Details
Description
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
A broken access control vulnerability has been identified in the Mautic Stats API endpoint (/api/stats/{table}). This vulnerability arises because the endpoint failed to enforce proper permissions for several internal tables. An intended restriction for administrator-only access was not implemented, and tables lacking explicit permission mappings were accessible by default. Consequently, any authenticated API user, including those with roles that grant no permissions, could read data from these tables. The exposed data includes the application audit log, which contains actions performed by all users and change details that may include personal contact information, stored visitor IP addresses with geolocation details, and tracked redirect URLs along with their channel mappings.
Users can upgrade to Mautic versions 5.2.12, 6.0.10, or 7.2.2 to address this vulnerability. For those using legacy Mautic 4 releases, general security support is available through the Extended Long-Term Support (ELTS) program.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mautic/mautic/security/advisories/GHSA-7j28-9rg4-wg63 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mautic | >= 2.3.0, < 5.2.12 (semver) >= 6.0.0, < 6.0.10 (semver) >= 7.0.0, < 7.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |