Description
Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue() where it is concatenated directly as a raw SQL column identifier ($col = 'l.'.$field) rather than being validated against a whitelist of real column names or passed as a bound parameter. Since Doctrine cannot parameterize identifiers, and the sanitizer does not block spaces, parentheses, or other SQL-relevant characters, an attacker can inject SQL via the field name itself. The action requires only a valid session (any authenticated user), unlike sibling actions in the same controller that carry additional permission checks.
Published: 2026-08-05
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Mautic’s Lead-by-Field-Value AJAX endpoint concatenates a user‑supplied field name directly into a SQL query without validating it against a whitelist. The field is only lightly sanitized, allowing an attacker who is logged in to inject arbitrary SQL by naming a column containing SQL syntax. This flaw, classified as CWE-89, can let authenticated users read or modify sensitive database contents, undermining confidentiality and integrity.

Affected Systems

The vulnerability affects Mautic installations. No specific product version range is listed in the CNA data, so all released versions that include the vulnerable getLeadIdsByFieldValueAction are potentially impacted.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity for authenticated attackers. EPSS is not available, and the flaw is not in the CISA KEV catalog, suggesting no confirmed public exploit yet. The attack vector is remote but requires an existing authenticated session; an attacker can trigger the vulnerable endpoint from any browser or automated client after logging in.

Generated by OpenCVE AI on August 5, 2026 at 12:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mautic to the latest released version that incorporates a whitelist or parameterized handling for the field name.
  • If an upgrade is not immediately possible, restrict access to the affected AJAX endpoint so that only privileged users can invoke it, or disable the action entirely for non‑admin accounts.
  • Add server‑side validation to confirm that the ‘field’ parameter matches a known column name before it is concatenated into the query string.
  • Monitor HTTP logs for repeated attempts to pass non‑alphanumeric characters in the field parameter, and alert on suspicious activity.

Generated by OpenCVE AI on August 5, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/mautic/mautic cve-icon
History

Wed, 05 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Mautic
Mautic mautic
Vendors & Products Mautic
Mautic mautic

Wed, 05 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Description Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue() where it is concatenated directly as a raw SQL column identifier ($col = 'l.'.$field) rather than being validated against a whitelist of real column names or passed as a bound parameter. Since Doctrine cannot parameterize identifiers, and the sanitizer does not block spaces, parentheses, or other SQL-relevant characters, an attacker can inject SQL via the field name itself. The action requires only a valid session (any authenticated user), unlike sibling actions in the same controller that carry additional permission checks.
Title Mautic: SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Mautic Mautic
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-05T12:35:45.574Z

Reserved: 2026-08-05T10:53:53.176Z

Link: CVE-2026-71245

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T12:30:12Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')