An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Insufficient recursive sanitization of nested query parameters allows an authenticated API user to bypass input filtering and inject arbitrary SQL commands. This can enable the attacker to read, modify or delete data stored in the database, thereby compromising confidentiality and integrity of the system's information.

The vulnerability affects the Mautic marketing automation platform’s API contact filtering functionality. All installations that expose this API and rely on the existing filtering logic are impacted. No specific version information is provided, so the risk applies to any deployment that includes the affected code paths.

The CVSS score of 7.1 indicates a medium‑to‑high impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The likely attack vector requires an authenticated API user, so an attacker would need valid credentials or an application that has legitimate access to the API to exploit this flaw. Once authenticated, the attacker can execute arbitrary SQL statements, leading to significant data compromise.