Description
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
Published: 2026-10-26
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized data exposure
Action: Apply patch
AI Analysis

Impact

A broken access‑control flaw in Mautic’s Stats API (/api/stats/{table}) allows any authenticated API user to read data from internal tables that were never protected by the intended administrator‑only restriction. Because tables without explicit permission mappings were marked readable by default, attackers can retrieve audit logs, contact personal data, visitor IP addresses with geolocation information, and tracked redirect URLs along with channel mappings.

Affected Systems

The vulnerability affects the Mautic open‑source marketing automation platform. No specific product versions are listed in the available data, so the flaw may impact all releases that have not applied a fix.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: authentication to the API is sufficient, and no additional privileges or local execution are required. An attacker with any API credential, even one that has no elevated permissions, can exploit the flaw to disclose sensitive data.

Generated by OpenCVE AI on October 26, 2026 at 15:53 UTC.

Remediation

Vendor Workaround

There are no official workarounds. To mitigate this vulnerability without upgrading, disable the API or restrict API access to trusted administrative users.

OpenCVE Recommended Actions

  • Upgrade or patch Mautic to a version in which the Stats API permission checks are correctly enforced.
  • If a patch is not yet available, temporarily disable the Stats API endpoint or restrict API access to trusted administrative users only.
  • Rotate or revoke API credentials belonging to users who should not have access to sensitive data.
  • Implement monitoring of audit logs to detect unauthorized API activity and review access controls regularly.

Generated by OpenCVE AI on October 26, 2026 at 15:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Mautic
Mautic mautic
Vendors & Products Mautic
Mautic mautic
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Broken Access Control in Mautic Stats API

Mon, 26 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Mautic Mautic
cve-icon MITRE

Status: PUBLISHED

Assigner: Mautic

Published:

Updated: 2026-10-26T15:35:52.798Z

Reserved: 2026-10-22T06:39:26.442Z

Link: CVE-2026-115195

cve-icon Vulnrichment

Updated: 2026-10-26T15:33:34.342Z

cve-icon NVD

Status : Deferred

Published: 2026-10-26T14:16:31.027

Modified: 2026-10-26T16:17:16.893

Link: CVE-2026-115195

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T16:15:14Z

Weaknesses