---
id: "CVE-2026-115192"
kind: "vulnerability"
aliases: ["CVE-2026-115192"]
title: "Mautic: dashboard widget filter lets authenticated API users run blind SQL"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["marketing-automation", "mautic", "package", "php", "self-hosted"]
not_affected_if: ["api-disabled", "no-api-users"]
published_at: "2026-10-26T14:16:30+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115192", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# Mautic: dashboard widget filter lets authenticated API users run blind SQL

The dashboard widget data endpoint at /api/data/{type} does not validate chart filter parameters before building database queries. An authenticated API user can inject SQL to read contact data and user password hashes, or slow the database down.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Mautic API is enabled in configuration and check which API users exist
- Check the installed Mautic version with `php bin/console mautic:version` and compare against the fixed release listed by the sources (unknown)

## Fix

- Upgrade Mautic to a release that validates dashboard widget filters (version unknown; sources do not name it)
- Disable the Mautic API if it is not needed
- Rotate user passwords and API credentials if exposure is suspected

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115192

## From the sources

An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_