6.5
MediumCVSS 3.1 · from Mautic
CVE-2026-115195
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}).
mautic/core · Missing authorization · CWE-862Affectedmautic/core
FixUpdate to 5.2.12, 6.0.10, 7.2.2 or newer
PublishedOct 26, 12:48 · Mautic
ScoredOct 26 · 6.5 · Mautic
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read data. CVSS impact.
Description
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
From Mautic
Affected and fixed versions
ProductAffectedFixed inmautic/core2.3.0 – before 5.2.125.2.12mautic/core6.0.0 – before 6.0.106.0.10mautic/core7.0.0 – before 7.2.27.2.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known