Mautic exposes a contact lookup AJAX endpoint (/s/ajax) that accepts a request parameter specifying the field to search by. The parameter is not validated before it is concatenated into an SQL query, allowing blind SQL injection. An attacker who is able to authenticate to Mautic, regardless of role, can run arbitrary boolean‑based or time‑based queries to read data that the Mautic database user can access, such as user accounts, email addresses, hashes, contact details, and campaign or email content. This leads to a full disclosure of sensitive data stored in the Mautic database.

The vulnerability affects the Mautic web application, specifically its administration interface. No specific version range is listed in the data; any installation using the unpatched /s/ajax endpoint is potentially affected.

The CVSS v3.1 score of 7.1 indicates a high risk of exploitation, and the EPSS score is not available, so the likelihood cannot be quantified. The flaw is listed as not being in CISA KEV, meaning there is no documented widespread exploitation. The only prerequisite for exploitation is authentication, and there are no role or permission restrictions, making it accessible to any Mautic user. Attackers would need to use blind SQL techniques, but the database response time can be used to infer information.