The vulnerability is a SQL injection flaw in Mautic’s Contact Activity API sorting mechanism, where the sort direction parameter is not restricted to a defined allowlist. This allows authenticated users to inject arbitrary SQL commands, enabling unauthorized database read or write operations and potentially exposing or corrupting data. The weakness is identified as CWE‑89, reflecting improper input validation that permits malicious query construction.

Mautic Mautic. All releases prior to 4.4.19, 5.2.10, 6.0.8, or 7.0.1 are affected because they lack the necessary input validation for the sort direction parameter. Any Mautic deployment running an older version remains vulnerable.

With a CVSS score of 7.6 the vulnerability is considered high severity, while an EPSS score of less than 1 % indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Attackers must have valid API credentials to reach the vulnerable endpoint, but once authenticated the flaw can be leveraged remotely over the network to execute arbitrary SQL against the underlying database, posing a significant confidentiality and integrity risk.