{"id":"CVE-2026-115196","kind":"vulnerability","aliases":["CVE-2026-115196"],"related":[],"title":"Mautic: form submission endpoint redirects visitors to arbitrary external sites","description":"An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.","summary":"The public form submission endpoint (/form/submit) in Mautic redirects the visitor to a return address supplied with the submission without checking that it stays on a trusted host. An attacker can use a legitimate Mautic domain to send visitors to phishing or malware sites.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketing","mautic","package","self-hosted"],"not_affected_if":["no-public-forms"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T14:16:31+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:43+00:00","updated_at":"2026-10-26T14:32:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T14:32:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Mautic: form submission endpoint redirects visitors to arbitrary external sites","impact":"low","summary":"The public form submission endpoint (/form/submit) in Mautic redirects the visitor to a return address supplied with the submission without checking that it stays on a trusted host. An attacker can use a legitimate Mautic domain to send visitors to phishing or malware sites.","category":"package","nicknames":[],"who_cares":["mautic","self-hosted","marketing"],"confidence":0.6,"needs_auth":"no","worst_case":"Visitors are sent from your domain to attacker-chosen external sites","analyst_note":"Find the affected and fixed Mautic versions in the NVD entry or the Mautic release notes; the sources give no version or patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-public-forms"],"who_is_affected":"Any Mautic instance with a published form is affected, since the public form submission endpoint is reachable without login. Exploitation requires a visitor to submit a form the attacker prepared, so the risk is mainly phishing from your domain. Instances with no public forms have no exposed endpoint.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000568,"input_tokens":3413,"output_tokens":453,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115196':13A,16A '-2026':12A,15A '/form/submit':28B,78C 'address':37B,94C 'affect':156C 'anoth':109C 'applic':87C 'arbitrari':8A,128C 'attack':52B,114C,168C 'check':43B 'cve':11A,14A 'deliv':146C 'domain':58B,125C 'endpoint':4A,27B,77C 'exampl':132C 'exist':71C 'exploit':116C,157C 'extern':9A,129C 'form':2A,25B,75C,83C,154C,164C 'host':22B,50B,111C 'imit':137C 'instanc':107C,150C 'land':140C 'legitim':56B,123C 'malwar':65B,147C 'market':17B 'mautic':1A,18B,30B,57B,80C,106C,124C,149C 'open':68C 'origin':139C 'packag':19B 'page':135C,141C 'phish':63B,134C 'point':103C 'prepar':165C 'public':24B,74C 'publish':153C 'redirect':5A,31B,69C,88C 'requir':158C 'return':36B,93C 'self':21B 'self-host':20B 'send':60B,119C 'site':10A,66B,144C 'stay':46B 'submiss':3A,26B,41B,76C,98C 'submit':85C,162C 'suppli':38B,95C 'trust':49B,110C 'unauthent':113C 'use':54B 'verifi':100C 'victim':160C 'visitor':6A,33B,61B,90C,120C 'vulner':70C 'websit':130C 'without':42B,99C","nicknames":[],"mitigations":[],"who_affected":"Any Mautic instance with a published form is affected, since the public form submission endpoint is reachable without login. Exploitation requires a visitor to submit a form the attacker prepared, so the risk is mainly phishing from your domain. Instances with no public forms have no exposed endpoint.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"security@mautic.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115196","severity":null,"published_at":"2026-10-26T14:16:31+00:00","modified_at":"2026-10-26T14:21:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}