Technical impact
An injection flaw exists in the dashboard widget data API endpoint where chart filter parameters are used unsafely to build database queries. This flaw enables a flaw that conforms to CWE-89, allowing a malicious actor to read arbitrary data from the Mautic database, including contacts, marketing data, and user account information with password hashes, via blind SQL injection techniques. The vulnerability does not allow data modification but can be used to slow queries, potentially affecting availability only in extreme cases.
Affected Systems
The affected product is Mautic, specifically its API endpoint that serves dashboard widget data. Any instance with the API enabled and accessible to an authenticated user is susceptible. No specific version range is listed in the available information.
Risk and Exploitability
The CVSS score of 7.1 positions this flaw as High severity. EPSS data is not available, so the empirical likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV, but it requires an authenticated user with API access, making it moderately difficult to exploit. If an attacker gains such access, they can read sensitive information via blind SQL injection, but cannot alter data.
