---
id: "CVE-2026-115195"
kind: "vulnerability"
aliases: ["CVE-2026-115195"]
title: "Mautic: Stats API lets any API user read audit log and contact data"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["marketing-automation", "mautic", "package", "php", "self-hosted"]
not_affected_if: ["api-disabled", "no-api-users"]
published_at: "2026-10-26T14:16:31+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115195", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# Mautic: Stats API lets any API user read audit log and contact data

The Mautic Stats API endpoint /api/stats/{table} skipped permission checks on several internal tables, so tables without an explicit permission mapping were readable by default. Any authenticated API user, even one with a role that grants no permissions, can read the audit log, visitor IP addresses and geolocation, and tracked redirect URLs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mautic version with `composer show mautic/core-lib` or the version shown in the admin footer.
- Review API user roles and tokens that can reach /api/stats/ on the instance.

## Fix

- Upgrade Mautic to the patched release listed by the sources (unknown).
- Rotate API credentials for users who should not have had access, if you suspect misuse.

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115195

## From the sources

A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_