{"id":"CVE-2026-115195","kind":"vulnerability","aliases":["CVE-2026-115195"],"related":[],"title":"Mautic: Stats API lets any API user read audit log and contact data","description":"A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.","summary":"The Mautic Stats API endpoint /api/stats/{table} skipped permission checks on several internal tables, so tables without an explicit permission mapping were readable by default. Any authenticated API user, even one with a role that grants no permissions, can read the audit log, visitor IP addresses and geolocation, and tracked redirect URLs.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketing-automation","mautic","package","php","self-hosted"],"not_affected_if":["api-disabled","no-api-users"],"how_to_check":"- Check the installed Mautic version with `composer show mautic/core-lib` or the version shown in the admin footer.\n- Review API user roles and tokens that can reach /api/stats/ on the instance.","fix":"- Upgrade Mautic to the patched release listed by the sources (unknown).\n- Rotate API credentials for users who should not have had access, if you suspect misuse.","status":"open","published_at":"2026-10-26T14:16:31+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:37+00:00","updated_at":"2026-10-26T14:32:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T14:32:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mautic to the patched release listed by the sources (unknown).\n- Rotate API credentials for users who should not have had access, if you suspect misuse.","reach":"network","title":"Mautic: Stats API lets any API user read audit log and contact data","impact":"medium","summary":"The Mautic Stats API endpoint /api/stats/{table} skipped permission checks on several internal tables, so tables without an explicit permission mapping were readable by default. Any authenticated API user, even one with a role that grants no permissions, can read the audit log, visitor IP addresses and geolocation, and tracked redirect URLs.","category":"package","nicknames":[],"who_cares":["mautic","self-hosted","php","marketing-automation"],"confidence":0.6,"needs_auth":"yes","worst_case":"Any API user reads audit logs, visitor IPs and contact data","analyst_note":"Find the patched Mautic version and affected version range in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115195 or the Mautic security advisory.","how_to_check":"- Check the installed Mautic version with `composer show mautic/core-lib` or the version shown in the admin footer.\n- Review API user roles and tokens that can reach /api/stats/ on the instance.","needs_analyst":true,"not_affected_if":["api-disabled","no-api-users"],"who_is_affected":"Teams running a self-hosted Mautic instance with the API enabled and at least one API user account, since any authenticated API user can reach the affected endpoint. Instances with the API disabled, or where API access is limited to trusted administrators, have a much smaller exposure, though the sources do not say which Mautic versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":3395,"output_tokens":627,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115195':16A,19A '-2026':15A,18A '/api/stats':34B,92C 'access':83C 'action':150C 'address':74B,167C 'administr':107C 'administrator-on':106C 'api':3A,6A,32B,56B,91C,129C 'appli':112C 'applic':146C 'audit':9A,70B,147C 'authent':55B,128C 'autom':22B 'broken':82C 'chang':156C 'channel':178C 'check':38B 'contact':12A,161C 'contain':160C 'control':84C 'could':138C 'cve':14A,17A 'data':13A,140C,163C 'default':53B,123C 'detail':157C,171C 'endpoint':33B,95C 'enforc':98C 'even':58B 'exist':86C 'explicit':47B,117C 'geoloc':76B,170C 'grant':64B,135C 'host':28B 'includ':131C,144C 'intend':105C 'intern':41B,102C 'ip':73B,166C 'let':4A 'log':10A,71B,148C 'map':49B,119C,179C 'market':21B 'marketing-autom':20B 'mautic':1A,23B,30B,89C 'may':159C 'never':111C 'one':59B,132C 'packag':24B 'perform':151C 'permiss':37B,48B,66B,99C,118C,137C 'person':162C 'php':25B 'read':8A,68B,139C 'readabl':51B,121C 'redirect':79B,174C 'restrict':109C 'result':126C 'role':62B,134C 'self':27B 'self-host':26B 'sever':40B,101C 'skip':36B 'stat':2A,31B,90C 'store':164C 'tabl':35B,42B,44B,93C,103C,114C,143C 'track':78B,173C 'url':80B,175C 'user':7A,57B,130C,154C 'visitor':72B,165C 'vulner':85C 'whose':133C 'without':45B,115C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Mautic instance with the API enabled and at least one API user account, since any authenticated API user can reach the affected endpoint. Instances with the API disabled, or where API access is limited to trusted administrators, have a much smaller exposure, though the sources do not say which Mautic versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@mautic.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115195","severity":null,"published_at":"2026-10-26T14:16:31+00:00","modified_at":"2026-10-26T14:21:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}