Live › vulnerability › CVE-2026-115195
Go to dashboardThe Mautic Stats API endpoint /api/stats/{table} skipped permission checks on several internal tables, so tables without an explicit permission mapping were readable by default. Any authenticated API user, even one with a role that grants no permissions, can read the audit log, visitor IP addresses and geolocation, and tracked redirect URLs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams running a self-hosted Mautic instance with the API enabled and at least one API user account, since any authenticated API user can reach the affected endpoint. Instances with the API disabled, or where API access is limited to trusted administrators, have a much smaller exposure, though the sources do not say which Mautic versions are affected.
No product ranges from the sources yet.
composer show mautic/core-lib or the version shown in the admin footer.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
This page as .md · .json · in your agent: get_signal("CVE-2026-115195")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.