{"id":"CVE-2026-115191","kind":"vulnerability","aliases":["CVE-2026-115191"],"related":[],"title":"Mautic: contact lookup endpoint lets any logged-in user run SQL","description":"A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.","summary":"The Mautic admin AJAX endpoint /s/ajax does not validate a parameter that selects the contact field to search, so it is injected into a database query. Any authenticated Mautic user, whatever their role, can use blind SQL injection to read the whole Mautic database, including user password hashes and contact data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mautic/core","fixed":["5.2.12","6.0.10","7.2.2"],"affected":">= 2.1.0, < 5.2.12; >= 6.0.0, < 6.0.10; >= 7.0.0, < 7.2.2","ecosystem":"composer"}],"ecosystems":[],"tags":["composer","mautic","package","php","self-hosted","sql-injection"],"not_affected_if":["auth-required","patched-5.2.12","patched-6.0.10","patched-7.2.2"],"how_to_check":"Run 'composer show mautic/core' or check the version in the Mautic admin. You are exposed if it is >=2.1.0 and <5.2.12, >=6.0.0 and <6.0.10, or >=7.0.0 and <7.2.2. To see attempts, search web server logs for requests to /s/ajax with action=lead:getLeadIdsByFieldValue.","fix":"Upgrade mautic/core to 5.2.12, 6.0.10 or 7.2.2 (match your release branch). Mautic 4 is covered only by ELTS. No official workaround; see the advisory's risk reduction steps.","status":"open","published_at":"2026-10-26T14:16:30+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:28+00:00","updated_at":"2026-10-26T14:33:03+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-26T14:32:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Mautic: contact lookup endpoint lets any logged-in user run SQL","impact":"high","summary":"The Mautic admin AJAX endpoint /s/ajax does not validate a parameter that selects the contact field to search, so it is injected into a database query. Any authenticated Mautic user, whatever their role, can use blind SQL injection to read the whole Mautic database, including user password hashes and contact data.","category":"package","nicknames":[],"who_cares":["mautic","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads the whole Mautic database, including password hashes","analyst_note":"Find the affected and fixed Mautic versions and the patch or workaround in the NVD entry or the Mautic project advisory, since the sources given do not name them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Any Mautic installation whose admin interface can be reached by a user with a login, since the flaw needs only an authenticated account of any role. The sources do not name the affected Mautic versions. Installations where the admin interface is restricted to trusted staff still carry risk from any account that can log in.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000575,"input_tokens":3423,"output_tokens":466,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Mautic versions and the patch or workaround in the NVD entry or the Mautic project advisory, since the sources given do not name them.","search":"'-115191':15A,18A '-2026':14A,17A '/s/ajax':35B,97C 'access':168C 'account':137C,172C 'address':175C 'admin':32B 'administr':95C 'ajax':33B,90C 'arbitrari':152C 'assign':134C 'attack':149C 'authent':57B,122C 'base':142C,146C 'blind':65B,139C 'boolean':141C 'boolean-bas':140C 'campaign':182C 'compos':20B 'contact':2A,44B,79B,88C,104C,179C 'content':185C 'cve':13A,16A 'data':80B,162C,180C 'databas':54B,73B,119C,158C,165C 'email':174C,184C 'endpoint':4A,34B,91C 'exist':85C 'exploit':126C 'field':45B,105C 'hash':77B,178C 'host':26B 'includ':74B,169C 'inject':29B,51B,67B,83C 'interfac':96C 'let':5A 'log':8A 'logged-in':7A 'lookup':3A,89C 'mautic':1A,21B,31B,58B,72B,94C,123C,157C,164C,170C 'mautic/core':19A 'packag':22B 'paramet':40B,100C 'password':76B,177C 'permiss':133C 'php':23B 'proper':111C 'queri':55B,120C,154C 'read':69B,160C 'regardless':128C 'request':99C 'role':62B,131C 'run':11A,151C 'search':47B,107C 'select':42B,102C 'self':25B 'self-host':24B 'sql':12A,28B,66B,82C,153C 'sql-inject':27B 'techniqu':147C 'time':145C 'time-bas':144C 'use':64B,116C,138C 'user':10A,59B,75B,124C,166C,171C 'valid':38B,112C 'vulner':84C 'whatev':60B 'whole':71B","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted Mautic where someone can log in to the admin interface. Any valid account works, whatever its role, and the attacker reads the whole Mautic database: user password hashes, contact data, campaign and email content. Installs where every account belongs to a trusted person carry less risk, but should still upgrade.","tier":"B","verified":{"fix":{"at":"2026-10-26T14:33:03Z","by":"analyst","run_id":832},"products":{"at":"2026-10-26T14:33:03Z","by":"analyst","run_id":832},"workarounds":{"at":"2026-10-26T14:33:03Z","by":"analyst","run_id":832},"how_to_check":{"at":"2026-10-26T14:33:03Z","by":"analyst","run_id":832},"who_affected":{"at":"2026-10-26T14:33:03Z","by":"analyst","run_id":832}},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","cvss_by":"security@mautic.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115191","severity":null,"published_at":"2026-10-26T14:16:30+00:00","modified_at":"2026-10-26T14:21:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115191:832","url":null,"severity":null,"published_at":"2026-10-26T14:33:03+00:00","modified_at":"2026-10-26T14:33:03+00:00","first_seen_at":"2026-10-26T14:33:03+00:00","fetched_at":"2026-10-26T14:33:03+00:00","note":"Read Mautic's GHSA-fj8v-c9c3-7q26 (CVE field blank on the page, but the text matches the NVD description exactly). Affected >=2.1.0 <5.2.12, >=6.0.0 <6.0.10, >=7.0.0 <7.2.2; fixed 5.2.12/6.0.10/7.2.2. No exploitation or PoC found; I did not search social posts."}],"documents":[{"id":3880,"url":"https://github.com/mautic/mautic/security/advisories/GHSA-fj8v-c9c3-7q26","title":"Mautic GHSA-fj8v-c9c3-7q26: SQL Injection in Contact Lookup AJAX Endpoint","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}