Every CVE Search/ Get API key

CVE-2026-4776

Mautic has SQL Injection in API Contact Filtering

7.1 HighFix available

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
Low

Exploit likelihood

0.22%Up 0.2 points since May 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Record
CVE-2026-4776
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2026-33256 7.1

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Record
EUVD-2026-33256
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-fcmw-wx57-9p75 7.1

Mautic has SQL Injection in API Contact Filtering

Summary

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Impact

An authenticated user with API access can exploit this vulnerability to execute arbitrary SQL queries against the underlying database. This allows unauthorized retrieval of sensitive database contents—including user credentials, system configurations, and personal identifiable information (PII) of contacts—bypassing standard data access permissions.

Patched Versions

This security issue has been fixed in the following releases:

  • 7.1.2
  • 6.0.9
  • 5.2.11
  • 4.4.20 ELTS

We strongly recommend upgrading to the latest version corresponding to your release branch.

Workarounds

There are no official workarounds. To mitigate this issue without upgrading, you may temporarily disable API access or restrict API permissions to highly trusted accounts.

Record
GHSA-fcmw-wx57-9p75
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-89
Updated
2026-11-02
NVD 7.1

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Record
CVE-2026-4776
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-89
Updated
2026-11-02
OSV 7.1

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Record
CVE-2026-4776
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-89
Updated
2026-11-02
OSVGHSA-fcmw-wx57-9p75 7.1

Mautic has SQL Injection in API Contact Filtering

Summary

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Impact

An authenticated user with API access can exploit this vulnerability to execute arbitrary SQL queries against the underlying database. This allows unauthorized retrieval of sensitive database contents—including user credentials, system configurations, and personal identifiable information (PII) of contacts—bypassing standard data access permissions.

Patched Versions

This security issue has been fixed in the following releases:

  • 7.1.2
  • 6.0.9
  • 5.2.11
  • 4.4.20 ELTS

We strongly recommend upgrading to the latest version corresponding to your release branch.

Workarounds

There are no official workarounds. To mitigate this issue without upgrading, you may temporarily disable API access or restrict API permissions to highly trusted accounts.

Record
GHSA-fcmw-wx57-9p75
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-89
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
mautic/core
Packagist
 2.6.0 to 4.4.13 None known
mautic/core
Packagist
 5.0.0 up to 5.2.11
5.2.11
mautic/core
Packagist
 6.0.0 up to 6.0.9
6.0.9
mautic/core
Packagist
 7.0.0 up to 7.1.2
7.1.2
mautic/core
Packagist
 2.6.0 to 4.4.13, plus listed versions
2.10.02.10.0-beta2.10.12.11.02.11.0-beta
Show 45 moreShow less
2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta2.14.22.14.2-beta2.15.02.15.0-beta2.15.12.15.1-beta2.15.22.15.2-beta2.15.32.15.3-beta2.16.02.16.0-beta2.16.12.16.1-beta2.16.22.16.2-beta2.16.32.16.3-beta2.16.42.16.52.6.12.7.02.7.12.8.02.8.12.8.22.9.02.9.0-beta2.9.12.9.23.0.03.0.0-alpha
 None known
mautic/core
Packagist
 5.0.0 up to 5.2.11, plus listed versions
5.0.15.0.25.0.35.0.45.1.0
Show 12 moreShow less
5.1.15.2.05.2.15.2.105.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.9
5.2.11
mautic/core
Packagist
 6.0.0 up to 6.0.9, plus listed versions
6.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.8
6.0.9
mautic/core
Packagist
 7.0.0 up to 7.1.2, plus listed versions
7.0.17.0.27.1.07.1.0-rc7.1.1
7.1.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-4776 is a high vulnerability (CVSS 7.1) in mautic/core, published May 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in mautic/core 5.2.11.

References

This page doesn't list everything

Left out here: 61 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open