CVE-2026-3105
SQL Injection in Contact Activity API Sorting
CVE-2026-3105 is a high vulnerability (CVSS 7.6) in Acquia Mautic, published February 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in mautic/core 5.2.10.
- Severity
- 7.6 HighCVSS 3.1, CVE List
- Exploit chance
- 0.33%EPSS, 26th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.2.10mautic/core +5 more
Description
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.
MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.
WorkaroundsNone.
ReferencesIf you have any questions or comments about this advisory:
Email us at security@mautic.org
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mautic/corePackagist | 2.10.0 up to 5.2.10 | 5.2.10 |
mautic/corePackagist | 6.0.0-alpha up to 6.0.8 | 6.0.8 |
mautic/corePackagist | 7.0.0-alpha up to 7.0.1 | 7.0.1 |
mautic/corePackagist | 2.10.0 up to 5.2.10, plus listed versions 2.10.12.11.02.11.0-beta2.12.02.12.0-beta Show 45 moreShow less2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta2.14.22.14.2-beta2.15.02.15.0-beta2.15.12.15.1-beta2.15.22.15.2-beta2.15.32.15.3-beta2.16.02.16.0-beta2.16.12.16.1-beta2.16.22.16.2-beta2.16.32.16.3-beta2.16.42.16.53.0.03.0.0-alpha3.0.0-beta3.0.0-beta23.0.13.0.23.0.2-rc3.1.03.1.0-rc3.1.13.1.1-rc3.1.23.1.2-rc3.2.0 | 5.2.10 |
mautic/corePackagist | 6.0.0-alpha up to 6.0.8, plus listed versions 6.0.06.0.0-beta26.0.0-rc6.0.16.0.2 Show 5 moreShow less6.0.36.0.46.0.56.0.66.0.7 | 6.0.8 |
mautic/corePackagist | 7.0.0-alpha up to 7.0.1, plus listed versions 7.0.07.0.0-beta7.0.0-rc7.0.0-rc2 | 7.0.1 |
What each source reports
CVE List Score used
SQL Injection in Contact Activity API Sorting
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.
MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.
WorkaroundsNone.
ReferencesIf you have any questions or comments about this advisory:
Email us at security@mautic.org
- Record
CVE-2026-3105- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-8548
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.
MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.
WorkaroundsNone.
ReferencesIf you have any questions or comments about this advisory:
Email us at security@mautic.org
- Record
EUVD-2026-8548- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r5j5-q42h-fc93
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting
Summary
This advisory addresses a SQL Injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.
Mitigation
Please update to 5.2.10, 6.0.8, 7.0.1 or later.
Workarounds
None.
References
If there are any questions or comments about this advisory:
Email Mautic at security@mautic.org
- Record
GHSA-r5j5-q42h-fc93- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.
MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.
WorkaroundsNone.
ReferencesIf you have any questions or comments about this advisory:
Email us at security@mautic.org
- Record
CVE-2026-3105- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
SQL Injection in Contact Activity API Sorting
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.
MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.
WorkaroundsNone.
ReferencesIf you have any questions or comments about this advisory:
Email us at security@mautic.org
- Record
CVE-2026-3105- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-r5j5-q42h-fc93
Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting
Summary
This advisory addresses a SQL Injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.
Mitigation
Please update to 5.2.10, 6.0.8, 7.0.1 or later.
Workarounds
None.
References
If there are any questions or comments about this advisory:
Email Mautic at security@mautic.org
- Record
GHSA-r5j5-q42h-fc93- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93
nvd.nist.gov/vuln/detail/CVE-2026-3105
packagist.org
Left out here: 73 versions. The JSON record has them.