CVE-2026-4776
mautic/core
HIGH 7.1
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 13 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Mautic
- NVD status
- Deferred
Description
An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.
Weaknesses (CWE)
- CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L | Mautic |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L | NVD · security@mautic.org (Secondary) |
Advisories
- GHSA-fcmw-wx57-9p75 — Mautic has SQL Injection in API Contact Filtering
European references
- ENISA EUVD · EUVD-2026-33256
- GCVE · GCVE-0-2026-4776
Affected products
| Product | Versions |
|---|---|
| mautic/core | affected 2.6.0 < 4.4.20 ; affected 5.0.0 < 5.2.11 ; affected 6.0.0 < 6.0.9 ; affected 7.0.0 < 7.1.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |