{"id":"CVE-2026-115192","kind":"vulnerability","aliases":["CVE-2026-115192"],"related":[],"title":"Mautic: dashboard widget filter lets authenticated API users run blind SQL","description":"An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.","summary":"The dashboard widget data endpoint at /api/data/{type} does not validate chart filter parameters before building database queries. An authenticated API user can inject SQL to read contact data and user password hashes, or slow the database down.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketing-automation","mautic","package","php","self-hosted"],"not_affected_if":["api-disabled","no-api-users"],"how_to_check":"- Confirm the Mautic API is enabled in configuration and check which API users exist\n- Check the installed Mautic version with `php bin/console mautic:version` and compare against the fixed release listed by the sources (unknown)","fix":"- Upgrade Mautic to a release that validates dashboard widget filters (version unknown; sources do not name it)\n- Disable the Mautic API if it is not needed\n- Rotate user passwords and API credentials if exposure is suspected","status":"open","published_at":"2026-10-26T14:16:30+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:26+00:00","updated_at":"2026-10-26T14:32:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T14:32:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mautic to a release that validates dashboard widget filters (version unknown; sources do not name it)\n- Disable the Mautic API if it is not needed\n- Rotate user passwords and API credentials if exposure is suspected","reach":"internet","title":"Mautic: dashboard widget filter lets authenticated API users run blind SQL","impact":"high","summary":"The dashboard widget data endpoint at /api/data/{type} does not validate chart filter parameters before building database queries. An authenticated API user can inject SQL to read contact data and user password hashes, or slow the database down.","category":"package","nicknames":[],"who_cares":["mautic","self-hosted","marketing-automation","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads contact data and password hashes from the database","analyst_note":"Sources do not name fixed versions or a patch; check the NVD entry and the Mautic release notes for the fixed version.","how_to_check":"- Confirm the Mautic API is enabled in configuration and check which API users exist\n- Check the installed Mautic version with `php bin/console mautic:version` and compare against the fixed release listed by the sources (unknown)","needs_analyst":true,"not_affected_if":["api-disabled","no-api-users"],"who_is_affected":"Mautic installations with the API enabled, where at least one user holds API access. Exploitation requires an authenticated API session, so instances with the API turned off or with only trusted API users have less exposure. Teams that do not run Mautic can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000628,"input_tokens":3438,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115192':14A,17A '-2026':13A,16A '/api/data':33B,76C 'access':107C 'account':141C 'also':150C 'api':7A,47B,74C,106C,178C 'arbitrari':127C 'attack':124C 'authent':6A,46B,103C 'autom':20B 'avail':165C 'blind':10A,119C 'build':42B,98C 'chart':38B,78C,100C 'client':84C 'contact':54B,134C 'cve':12A,15A 'dashboard':2A,28B,71C,99C 'data':30B,55B,73C,101C,128C,138C,142C,166C 'databas':43B,63B,95C,132C,156C 'enabl':181C 'endpoint':31B,75C 'exist':68C 'exploit':109C,174C 'filter':4A,39B,79C 'hash':59B,145C 'host':26B 'impact':163C 'includ':133C 'inject':50B,66C,112C,121C,147C 'let':5A 'limit':162C 'market':19B,137C 'marketing-autom':18B 'mautic':1A,21B,131C,177C 'modif':167C 'packag':22B 'paramet':40B,80C 'password':58B,144C 'php':23B 'possibl':170C 'proper':87C 'queri':44B,96C,117C,157C 'read':53B,126C 'report':116C 'requir':175C 'run':9A 'self':25B 'self-host':24B 'slow':61B,154C 'sql':11A,51B,65C,113C,120C,148C 'suppli':81C 'techniqu':122C 'type':34B,77C 'use':92C,118C,152C 'user':8A,48B,57B,104C,140C 'valid':37B,88C 'vulner':67C,173C 'widget':3A,29B,72C","nicknames":[],"mitigations":[],"who_affected":"Mautic installations with the API enabled, where at least one user holds API access. Exploitation requires an authenticated API session, so instances with the API turned off or with only trusted API users have less exposure. Teams that do not run Mautic can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","cvss_by":"security@mautic.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115192","severity":null,"published_at":"2026-10-26T14:16:30+00:00","modified_at":"2026-10-26T14:21:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}