CVE-2026-115195

Broken Access Control in Mautic Stats API

Published Oct 26, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.

Analysis

Technical impact

A broken access‑control flaw in Mautic’s Stats API (/api/stats/{table}) allows any authenticated API user to read data from internal tables that were never protected by the intended administrator‑only restriction. Because tables without explicit permission mappings were marked readable by default, attackers can retrieve audit logs, contact personal data, visitor IP addresses with geolocation information, and tracked redirect URLs along with channel mappings.

Affected Systems

The vulnerability affects the Mautic open‑source marketing automation platform. No specific product versions are listed in the available data, so the flaw may impact all releases that have not applied a fix.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: authentication to the API is sufficient, and no additional privileges or local execution are required. An attacker with any API credential, even one that has no elevated permissions, can exploit the flaw to disclose sensitive data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

unaffected

Version	Status	Constraints
`2.3.0`	affected	< 5.2.12
`6.0.0`	affected	< 6.0.10
`7.0.0`	affected	< 7.2.2

No data.

Vendor Product Versions

Mautic

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

There are no official workarounds. To mitigate this vulnerability without upgrading, disable the API or restrict API access to trusted administrative users.

OpenCVE Recommended Actions

Upgrade or patch Mautic to a version in which the Stats API permission checks are correctly enforced.
If a patch is not yet available, temporarily disable the Stats API endpoint or restrict API access to trusted administrative users only.
Rotate or revoke API credentials belonging to users who should not have access to sensitive data.
Implement monitoring of audit logs to detect unauthorized API activity and review access controls regularly.

Generated by OpenCVE AI on October 26, 2026 at 15:53 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.336% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/mautic/mautic/security/advisories/GHSA-7j28-9rg4-wg63

History

Oct 26, 2026 4:30 PM First appearance in the feed. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Mautic Mautic mautic
Vendors & Products		Mautic Mautic mautic
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 4:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Broken Access Control in Mautic Stats API

Oct 26, 2026 2:00 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
Weaknesses		CWE-862
References		https://github.com/mautic/mautic/security/advisories/GHSA-7j28-9rg4-wg63
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`