Every CVE Search/ Get API key

CVE-2022-25768

Improper Access Control in UI upgrade process

7.0 HighFix available

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.29%Up 0.2 points since Sep 19, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.0

Improper Access Control in UI upgrade process

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Record
CVE-2022-25768
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2024-2891 7.0

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Record
EUVD-2024-2891
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-x3jx-5w6m-q2fc 8.3

Mautic vulnerable to Improper Access Control in UI upgrade process

Impact

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Patches

Upgrade to 4.4.13 or 5.1.1 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-x3jx-5w6m-q2fc
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-284, CWE-287, CWE-862
Updated
2026-11-02
NVD 7.0

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Record
CVE-2022-25768
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-287, CWE-862
Updated
2026-11-02
OSV 7.0

Improper Access Control in UI upgrade process

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Record
CVE-2022-25768
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-287
Updated
2026-11-02
OSVGHSA-x3jx-5w6m-q2fc 8.3

Mautic vulnerable to Improper Access Control in UI upgrade process

Impact

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

Patches

Upgrade to 4.4.13 or 5.1.1 or later.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-x3jx-5w6m-q2fc
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-284, CWE-287, CWE-862
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mautic/core-lib
Packagist
 1.1.3 up to 4.4.13
4.4.13
mautic/core-lib
Packagist
 5.0.0-alpha up to 5.1.1
5.1.1
mautic/core
Packagist
 1.1.3 up to 4.4.13
4.4.13
mautic/core
Packagist
 5.0.0-alpha up to 5.1.1
5.1.1
mautic/core-lib
Packagist
 1.1.3 up to 4.4.13, plus listed versions
4.0.04.0.0-alpha14.0.0-beta4.0.0-rc4.0.1
Show 27 moreShow less
4.0.24.1.04.1.14.1.24.2.04.2.0-rc4.2.0-rc14.2.14.2.24.3.04.3.0-beta4.3.0-rc4.3.14.4.04.4.14.4.1-alpha4.4.104.4.114.4.124.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9
4.4.13
mautic/core-lib
Packagist
 5.0.0-alpha up to 5.1.1, plus listed versions
5.0.05.0.0-alpha15.0.0-beta15.0.0-beta25.0.0-rc1
Show 6 moreShow less
5.0.0-rc25.0.15.0.25.0.35.0.45.1.0
5.1.1
mautic/core
Packagist
 1.1.3 up to 4.4.13, plus listed versions
1.2.01.2.0-beta11.2.11.2.21.2.3
Show 45 moreShow less
1.2.41.3.01.3.11.4.01.4.12.0.02.0.12.1.02.1.12.10.02.10.0-beta2.10.12.11.02.11.0-beta2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta2.14.22.14.2-beta2.15.02.15.0-beta2.15.12.15.1-beta2.15.22.15.2-beta2.15.32.15.3-beta2.16.02.16.0-beta2.16.12.16.1-beta2.16.22.16.2-beta2.16.32.16.3-beta
4.4.13
mautic/core
Packagist
 5.0.0-alpha up to 5.1.1, plus listed versions
5.0.05.0.0-alpha15.0.0-beta15.0.0-beta25.0.0-rc1
Show 6 moreShow less
5.0.0-rc25.0.15.0.25.0.35.0.45.1.0
5.1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-25768 is a high vulnerability (CVSS 7.0) in Acquia Mautic, published September 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in mautic/core-lib 4.4.13.

References

This page doesn't list everything

Left out here: 82 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open