---
id: "CVE-2026-115191"
kind: "vulnerability"
aliases: ["CVE-2026-115191"]
title: "Mautic: contact lookup endpoint lets any logged-in user run SQL"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mautic/core", "fixed": ["5.2.12", "6.0.10", "7.2.2"], "affected": ">= 2.1.0, < 5.2.12; >= 6.0.0, < 6.0.10; >= 7.0.0, < 7.2.2", "ecosystem": "composer"}]
ecosystems: []
tags: ["composer", "mautic", "package", "php", "self-hosted", "sql-injection"]
not_affected_if: ["auth-required", "patched-5.2.12", "patched-6.0.10", "patched-7.2.2"]
published_at: "2026-10-26T14:16:30+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:33:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115191", "first_seen_at": "2026-10-26T14:30:36+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T14:33:03+00:00"}]
---

# Mautic: contact lookup endpoint lets any logged-in user run SQL

The Mautic admin AJAX endpoint /s/ajax does not validate a parameter that selects the contact field to search, so it is injected into a database query. Any authenticated Mautic user, whatever their role, can use blind SQL injection to read the whole Mautic database, including user password hashes and contact data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:mautic/core affected >= 2.1.0, < 5.2.12; >= 6.0.0, < 6.0.10; >= 7.0.0, < 7.2.2 fixed 5.2.12, 6.0.10, 7.2.2

## How to check

Run 'composer show mautic/core' or check the version in the Mautic admin. You are exposed if it is >=2.1.0 and <5.2.12, >=6.0.0 and <6.0.10, or >=7.0.0 and <7.2.2. To see attempts, search web server logs for requests to /s/ajax with action=lead:getLeadIdsByFieldValue.

## Fix

Upgrade mautic/core to 5.2.12, 6.0.10 or 7.2.2 (match your release branch). Mautic 4 is covered only by ELTS. No official workaround; see the advisory's risk reduction steps.

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115191
- 2026-10-26T14:33:03+00:00 analyst — Read Mautic's GHSA-fj8v-c9c3-7q26 (CVE field blank on the page, but the text matches the NVD description exactly). Affected >=2.1.0 <5.2.12, >=6.0.0 <6.0.10, >=7.0.0 <7.2.2; fixed 5.2.12/6.0.10/7.2.2. No exploitation or PoC found; I did not search social posts.

## Documents

- [advisory] Mautic GHSA-fj8v-c9c3-7q26: SQL Injection in Contact Lookup AJAX Endpoint https://github.com/mautic/mautic/security/advisories/GHSA-fj8v-c9c3-7q26

## From the sources

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_