Every CVE Search/ Get API key

CVE-2026-9557

Mautic Focus component Vulnerable to SSRF

6.4 MediumFix available

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.15%Up 0.1 points since May 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.4

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.

Record
CVE-2026-9557
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2026-33273 6.4

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.

Record
EUVD-2026-33273
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jmv8-8j9j-rcpc 6.4

Mautic Focus component Vulnerable to SSRF

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the Mautic Focus component (MauticFocusBundle). Under certain conditions, insufficiency in validating user-supplied URLs allows authenticated users to trigger outbound HTTP requests from the hosting server.

Impact

An authenticated user with access to the Mautic panel can exploit this vulnerability to perform internal port probing or force the server to initiate requests to external or arbitrary internal destinations. This can enable internal network reconnaissance or mapping of firewalled infrastructure.

Patched Versions

This security issue has been fixed in the following releases:

  • 7.1.2
  • 6.0.9
  • 5.2.11
  • 4.4.20 ELTS

Mautic strongly recommend upgrading to the latest version corresponding to your release branch.

Workarounds

There are no official workarounds. To completely mitigate the exposure without upgrading, disabling or limiting external network access from the Mautic web server to internal-only subnets/local hosts is recommended.

Record
GHSA-jmv8-8j9j-rcpc
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 6.4

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.

Record
CVE-2026-9557
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-02
OSV 6.4

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.

Record
CVE-2026-9557
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVGHSA-jmv8-8j9j-rcpc 6.4

Mautic Focus component Vulnerable to SSRF

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the Mautic Focus component (MauticFocusBundle). Under certain conditions, insufficiency in validating user-supplied URLs allows authenticated users to trigger outbound HTTP requests from the hosting server.

Impact

An authenticated user with access to the Mautic panel can exploit this vulnerability to perform internal port probing or force the server to initiate requests to external or arbitrary internal destinations. This can enable internal network reconnaissance or mapping of firewalled infrastructure.

Patched Versions

This security issue has been fixed in the following releases:

  • 7.1.2
  • 6.0.9
  • 5.2.11
  • 4.4.20 ELTS

Mautic strongly recommend upgrading to the latest version corresponding to your release branch.

Workarounds

There are no official workarounds. To completely mitigate the exposure without upgrading, disabling or limiting external network access from the Mautic web server to internal-only subnets/local hosts is recommended.

Record
GHSA-jmv8-8j9j-rcpc
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-918
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
mautic/core
Packagist
 4.0.0 to 4.4.13 None known
mautic/core
Packagist
 5.0.0 up to 5.2.11
5.2.11
mautic/core
Packagist
 6.0.0 up to 6.0.9
6.0.9
mautic/core
Packagist
 7.0.0 up to 7.1.2
7.1.2
mautic/core
Packagist
 4.0.0 to 4.4.13, plus listed versions
4.0.14.0.24.1.04.1.14.1.2
Show 23 moreShow less
4.2.04.2.0-rc4.2.0-rc14.2.14.2.24.3.04.3.0-beta4.3.0-rc4.3.14.4.04.4.0-beta4.4.14.4.104.4.114.4.124.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9
 None known
mautic/core
Packagist
 5.0.0 up to 5.2.11, plus listed versions
5.0.15.0.25.0.35.0.45.1.0
Show 12 moreShow less
5.1.15.2.05.2.15.2.105.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.9
5.2.11
mautic/core
Packagist
 6.0.0 up to 6.0.9, plus listed versions
6.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.8
6.0.9
mautic/core
Packagist
 7.0.0 up to 7.1.2, plus listed versions
7.0.17.0.27.1.07.1.0-rc7.1.1
7.1.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9557 is a medium vulnerability (CVSS 6.4) in mautic/core, published May 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 3rd percentile. Fixed in mautic/core 5.2.11.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open