Live › vulnerability › CVE-2026-115196
Go to dashboardThe public form submission endpoint (/form/submit) in Mautic redirects the visitor to a return address supplied with the submission without checking that it stays on a trusted host. An attacker can use a legitimate Mautic domain to send visitors to phishing or malware sites.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Any Mautic instance with a published form is affected, since the public form submission endpoint is reachable without login. Exploitation requires a visitor to submit a form the attacker prepared, so the risk is mainly phishing from your domain. Instances with no public forms have no exposed endpoint.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.
This page as .md · .json · in your agent: get_signal("CVE-2026-115196")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.