Live › vulnerability › CVE-2026-115192
Go to dashboardThe dashboard widget data endpoint at /api/data/{type} does not validate chart filter parameters before building database queries. An authenticated API user can inject SQL to read contact data and user password hashes, or slow the database down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Mautic installations with the API enabled, where at least one user holds API access. Exploitation requires an authenticated API session, so instances with the API turned off or with only trusted API users have less exposure. Teams that do not run Mautic can skip it.
No product ranges from the sources yet.
php bin/console mautic:version and compare against the fixed release listed by the sources (unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-115192")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.